The bug came from two overlapping problems. Cloudflare had deployed GLM-5.3 with a 1,048,576-token context window, but the KV cache pool on its prefill GPUs only had room for 681,280 tokens. Cloudflare says it knew of the mismatch before launch but expected the engine, SGLang, to reject over-length prompts with an error; its tests instead returned successful responses. A second SGLang bug meant such rejected requests were not aborted: a one-token placeholder was processed and its cache transferred to the decode node, which then generated responses while attending over stale cache pages still holding data from earlier requests.

The exposure was possible because of a common performance trade-off: KV cache pages in GPU memory are not zeroed between requests, so the engine itself is responsible for tracking who owns each page, and a tracking bug can therefore leak data across tenants.

Between August 27 and September 9, 155 responses were affected, all to prompts longer than 681,280 tokens. Cloudflare says the identified requests look consistent with ordinary long-context use and it found no evidence of deliberate exploitation. It also confirmed no other Workers AI model was affected.

The fix works on two levels. Cloudflare resized the cache pool to roughly 2.04 million tokens, about twice the context length, so valid prompts never hit the rejection path. It also patched SGLang so rejected requests are retired with their original error before any cache transfer, and proposed the change upstream alongside a decode-side check that transferred tokens match reserved tokens. Related fixes were already merged in SGLang, including one on September 6 for a related failure path. Both changes were validated against the researcher's reproduction script before the model went back online.