Cloudflare Patches GLM-5.3 KV Cache Data Leak in Workers AI

Cloudflare has patched a critical security vulnerability in its Workers AI platform that allowed cross-request KV cache exposure in the GLM-5.3 model. Security researchers reported that improper memory isolation enabled subsequent API requests to access residual key-value cache data from previous users' sessions. The flaw potentially exposed sensitive prompts and model context between unrelated tenants on shared inference infrastructure. Cloudflare confirmed the issue and deployed a fix to enforce strict memory sanitization between requests. The company stated no evidence of malicious exploitation was found prior to remediation. This incident underscores persistent challenges in securing multi-tenant large language model serving environments. Industry experts note that KV cache management remains an under-audited attack surface in serverless AI deployments. The vulnerability affected only the GLM-5.3 model variant hosted on Workers AI. Cloudflare has since updated its security documentation regarding tenant isolation guarantees.