Cross-request KV cache exposure in the GLM-5.3 Workers AI model (155 responses)

This doesn't really have anything to do with GLM-5.3. This is what happens when you share models between users and don't do your bookkeeping properly, the actual model doesn't matter. What it shows is that there isn't enough isolation between the user sessions and that memory can overlap when that should never be possible.

This is an SGLANG and a Cloudflare bug long before it is a Z.AI model bug, I don't see what they could have done about it. Cloudflare should own it instead of naming other (imo innocent) parties in the title.

I like this RCA a lot more than most. I appreciate the ownership and clear explanation of why their testing did not catch this bug.

Also impressed with the speed to address the issue unplug the model and then pretty quick remediation, the speed to remediation matters less to me, but good to see they can act quickly on their platform to kill the serving of the model.

"We deployed GLM 5.3 with a 1,048,576-token context window, but the KV cache pool on our prefill GPUs only had room for 681,280 tokens. We were aware of this mismatch before launch. "

Did they advertise it as 1,048,576 token when they only had room for 681,280 tokens?

Other providers probably don't even know/care that this is happening

Please consider to update the title in: Cross-request KV cache exposure in the AI model workers

Interesting. That might explain the few times I've received completely unrelated responses from a certain provider's API.

Reminds me of a bug I found in a very popular browser testing service that spun up iOS vm's/devices for on-device testing.

I copied the clipboard from the device, and my clipboard was full of another users credentials that they were obviously trying to paste into their own VM. Their devices were leaking clipboard data to each other.

I reported the vulnerability and asked if there was any bounty program (I wasn't looking for vulnerabilities but didn't hurt to ask), to which they said no, but they could send me a signed letter thanking me of my contributions. I said, great, thanks - and never heard back.

All pretty disappointing.

Is anyone even offering single tenant inference as a service?

Is that a new class of tenant isolation vulnerability?

I kind of forgot about the shared tenancy attack model. I think I was assuming/hoping the software was magically isolating my tokens, when in reality that's impossible for shared tenants. There's whole classes of attacks on things like shared cache, before we get to the LLM-specific features and potential bugs. Enterprises with highly sensitive data should really be on non-shared hosts.