Cloudflare Workers AI cross-request KV cache exposure: GLM-5.3 returned another tenant's inference content

Cloudflare documented that on Workers AI, sufficiently large prompts to the GLM-5.3 model could trigger an SGLang defect causing cross-request KV-cache exposure, so a request returned another customer's inference content instead of its own answer. Approximately 155 responses to very long prompts returned data from other customers between 2026-08-27 and 2026-09-09. Cloudflare traced the root cause to the upstream open-source SGLang engine, has since fixed its deployment, found no evidence of deliberate exploitation, and recommends SGLang operators update to version 0.5.22 or later.

This is a confirmed multi-tenant inference data-isolation failure in a major hosted AI platform: an attacker (or deterministic overload) could read another tenant's model outputs, and by extension the sensitive content being processed by their AI workload. It underscores that prompt/context isolation in shared inference infrastructure depends on the serving engine's memory management, and that the same SGLang tree is implicated in both the Cloudflare data leak and the NEAR AI RCE breach in the same window.

Client sends a very long prompt that trips the SGLang cross-request KV-cache bug, causing another tenant's cached inference context to be returned in the response.

Cloudflare Workers AI (GLM-5.3 provider) and the underlying SGLang inference engine (update to 0.5.22+)

Apply the Cloudflare fix; SGLang operators upgrade to 0.5.22+; enable per-tenant cache isolation and monitor for anomalous identical-output responses; treat no deliberate exploitation as a risk-reduction, not a fix.