{
  "id": 16671586,
  "title": "Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)",
  "url": "https://urgent.news/2026/10/26/cross-request-kv-cache-exposure-in-the-glm-5-3-workers-ai-model-155",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-26T22:41:48.000Z",
  "source": {
    "name": "Hacker News",
    "slug": "hacker-news",
    "url": "https://blog.cloudflare.com/kv-cache-exposure-remediation/"
  },
  "original_language": "en",
  "account": "On September 8, 2026, Cloudflare received notice from security researcher Gadi Evron about a problem in the GLM-5.3 Workers AI model. The issue, reported via Cloudflare's HackerOne program, caused responses to contain data from other customers' requests. Cloudflare worked quickly to identify and fix the problem, restoring service on September 9. The issue stemmed from a misconfiguration of the open-source inference engine, SGLang, which had a 1,048,576-token context window but only had space for 681,280 tokens in its KV cache pool. Additionally, a bug in SGLang's handling of over-length requests led to stale data being included in responses. Cloudflare corrected the configuration by increasing the pool size, patched the engine to handle rejections safely, and proposed these changes upstream.",
  "summary": null,
  "key_points": [
    "Cloudflare notified about KV cache exposure in GLM-5.3 Workers AI model on September 8, 2026",
    "Misconfiguration of SGLang caused stale data inclusion in responses",
    "Cloudflare increased KV cache pool size and patched SGLang to fix issue"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}