CROSS-REQUEST KV CACHE EXPOSURE IN THE GLM-5.3 WORKERS AI MODEL, AND OUR REMEDIATION WITH SGLANG

Summary from the TLDR InfoSec newsletter

Prompts longer than 681,280 tokens sent to Cloudflare's GLM-5.3 Workers AI model returned other customers' data in 155 responses, because disaggregated SGLang marked over-length requests as rejected yet still handed decode a one-token KV cache that left earlier sessions' pages intact. Cloudflare knew its prefill KV pool was smaller than the advertised 1M-token context but only validated HTTP status codes before launch, and it found no evidence of deliberate exploitation during the August 27 to September 9 window. Operators running disaggregated SGLang should upgrade to v0.5.22 or later, verify KV pool size against context length on every node, and enable --disaggregation-enable-kv-checksum where their model supports it.