Refused, Then Answered

How an over-length prompt exposed other customers' data through Cloudflare's GLM-5.3 inference cache.

Gadi Evron was working on an unrelated task through OpenRouter when the model began returning unfamiliar material: file paths from a machine that wasn't his, Chinese-language tutorials he hadn't requested, and other unexpected output.

Evron, CEO of cybersecurity company Knostic, traced the behavior to Cloudflare's hosted GLM-5.3 model. His investigation uncovered a cross-customer exposure that Cloudflare later confirmed had produced 155 affected responses between August 27 and September 9, 2026.

Knostic observed personal names, client names, invoice numbers, euro amounts, payment dates, source-code information, filesystem paths, and AI agent task records. Cloudflare confirmed that affected responses contained data from other customers' requests.

The inference engine had already decided to reject the incoming prompt. It just never told the rest of the pipeline.

Where the Rejection Got Lost

Cloudflare launched GLM-5.3 with an advertised context window of 1,048,576 tokens. Its prefill GPU cache could accommodate only 681,280 tokens, roughly 65% of that limit.

Cloudflare knew about the mismatch before launch. Engineers expected SGLang, the open-source inference engine, to reject requests exceeding available memory. Pre-launch tests returned successful HTTP responses, which the team interpreted as evidence that long-context handling worked.

The problem emerged in SGLang's disaggregated architecture, where separate GPU workers handle prefill, which processes the prompt into key-value (KV) cache state, and decode, which uses that state to generate responses.

When a prompt exceeded prefill capacity, SGLang recorded a pending rejection and substituted a one-token placeholder. But its admission queues checked whether the request had finished, rather than whether it had been rejected. The request continued. Another user had reported the over-length handling behavior to SGLang on July 6, weeks before GLM-5.3 launched, according to Cloudflare.

Decode had reserved memory for the original long prompt. Prefill processed the placeholder, transferred a fraction of the expected KV data, and signaled completion.

Cloudflare's diagram illustrates the failure using eight reserved cache pages. Think of it as handing someone the keys to an eight-room suite after cleaning only one room. The remaining rooms still contain the previous occupants' belongings.

Decode similarly treated all eight pages as valid, although only the first contained newly written state. Its attention computation read the remaining pages, which still held earlier customers' prompts and partial generations.

The customer received HTTP 200 instead of the expected HTTP 400, with a coherent response containing someone else's information.

Why not simply erase the memory between requests?

Cloudflare explains that KV-cache pages are ordinarily reused without zeroing because clearing them carries a performance cost. The engine relies on accurate ownership tracking and overwriting instead. Zeroing pages on release remained a draft proposal at disclosure.

Without zeroing, the only thing standing between customers is bookkeeping.

Every Dashboard Said Success

Cloudflare's pre-launch tests checked response status codes and performance without examining generated content for cross-request contamination. The monitored indicators could look healthy while the one property that mattered, customer isolation, had already failed.

Evron submitted his HackerOne report at 23:11 UTC on September 8. Cloudflare began verification the following morning and declared a security incident at 13:22 UTC on September 9, reproducing the leak with two independent accounts within 25 minutes.

At 14:00 UTC, 38 minutes after declaring the incident, Cloudflare restricted public access to the model. Engineers identified the cache-capacity mismatch, increased the allocation, and deployed an engine patch. Service was restored at 19:40 UTC that evening.

Cloudflare says a small number of customers were affected and found no evidence of deliberate exploitation. The exact number of distinct customers and a per-response breakdown of exposed information remain unpublished.

The Write That Arrived After Checkout

The investigation also accelerated work on a separate SGLang memory-lifecycle defect. This race did not cause Cloudflare's 155 reported responses.

In the related failure, a canceled request could release its cache pages while remote direct memory access (RDMA) writes were still in flight. Another request could inherit those pages before the earlier writes arrived.

SGLang reproduced the race on H200 GPUs. During one test, the victim request's output turned into the other request's prompt text.

The fix delays page reuse until outstanding transfers have drained. SGLang's benchmarks found no statistically measurable throughput penalty in the tested configuration.

When Reserved Memory Is Still Someone Else's

Cloudflare recommends SGLang v0.5.22 or later. SGLang includes a further failed-transfer fix for NIXL and MORI in v0.5.23, published to PyPI on October 30 and released on GitHub on November 2. Operators using those backends should verify their deployed versions.

Operational checks need to compare actual KV capacity against configured context limits, validate rejected-request handling, and test cancellation during transfers. Optional integrity checks offer additional detection, although coverage remains limited.

The central failure was a mismatch between memory allocation and memory ownership. Decode had reserved the pages, received a completion signal, and proceeded to generate an answer. None of those steps established that the pages contained the current customer's data.

The eight rooms had been assigned. Seven still belonged to someone else's conversation.

Further Reading

• Cloudflare, Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (October 26, 2026)
• SGLang Team, SGLang security update: improving request isolation (October 26, 2026)
• Gadi Evron, Knostic, Hallucination or Cross-Tenant: When an LLM Answers With Another User's Context (October 27, 2026)