Cloudflare says that between Aug 27 and Sept 9, 155 responses from @cf/zai-org/glm-5.3 on Workers AI contained data from other customers' requests made to the same model shortly before, all for prompts longer than 681,280 tokens. No other Workers AI model was affected, and Cloudflare found no evidence of deliberate exploitation. Knostic researcher Gadi Evron reported it on Sept 8 after tracing an anomaly seen through OpenRouter.

• Cause 1: the model was offered with a 1,048,576-token context window, but the prefill GPUs' KV cache pool held only 681,280 tokens. Cloudflare says it knew about the mismatch but expected over-length prompts to error out.
• Cause 2: in SGLang's disaggregated prefill/decode mode, a rejected over-length prompt was swapped for a one-token placeholder instead of aborted; decode then generated a reply while attending over stale cache pages still holding earlier users' data.
• Fix: Cloudflare enlarged the pool to about 2.04M tokens and patched the rejection path; upstream fixes are in SGLang PRs #36988 and #38935, released in v0.5.22. Cloudflare customers need take no action.

If you self-host SGLang in disaggregated mode: update to 0.5.22 or later, and check that each node's KV pool size in its startup log is at least the advertised context length after any change to weights, quantization or parallelism.