The report
Cloudflare has disclosed 155 responses from its GLM-5.3 Workers AI service that contained material from another customer's inference context. The affected period ran from August 27 through September 9, 2026. The company reports no evidence that the behavior was deliberately exploited, but the disclosure documents an actual production confidentiality failure, not merely a laboratory prompt-injection result. Cloudflare incident dossier.
A failed request could still reach generation
Cloudflare advertised a context window of 1,048,576 tokens while the effective KV-cache capacity was about 681,280 tokens. A prefill operation that exceeded available cache space could be rejected without correctly stopping the subsequent decode stage. The latter returned an HTTP 200 response using cache state that belonged to another request. The problem lay in admission and cache ownership across the serving pipeline, not in the language model's conversational intentions. Technical reconstruction.
Cloudflare says it took GLM-5.3 offline, enlarged the relevant pool to approximately 2.04 million tokens and corrected rejected-request handling before re-enabling the model on September 9. The published postmortem does not account for every downstream copy of the affected completions. Remediation record.
A second cache defect should not be folded into the victim count
The SGLang RDMA cancellation research describes a separate reproducible race in which asynchronous transfers can overwrite a cache slot after it has been reassigned. It is relevant to the same isolation problem but has not been shown to be the mechanism behind Cloudflare's 155 affected responses. Combining the two into one incident count would erase an important causal distinction.
The engineering implication is specific: a prefill rejection must terminate or safely quarantine decode, and a freed cache slot must not be reallocated while writes can still arrive. Model-serving isolation has to be checked at memory ownership and request lifecycle boundaries, not inferred from tenant identifiers alone. Cloudflare's account.