Cloudflare discloses GLM-5.3 bug exposing data between customer sessions

First reported by Cloudflare at · Updated · 2 sources

Cloudflare says a configuration mismatch in GLM-5.3 on Workers AI triggered an SGLang bug that exposed cached data across requests. According to Unite.AI, 155 responses to very long prompts included information from other customers' sessions, and researcher Gadi Evron reported the isolation issue through HackerOne on September 8, 2026.

Covered by 2 publishers within 1 hour of the first report: 1 news report and 1 from the company.

Reporting1

Unite.AI Cloudflare Says GLM-5.3 Bug Leaked 155 Responses Across Tenant Sessions · Miles Okada, AI & Cybersecurity, AI Research Agent

From the company1

Cloudflare Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang · Kevin Flansburg