Cloudflare's own disclosure: 155 GLM-5.3 responses leaked other customers' data, and Z.AI's name travels
Cloudflare disclosed that 155 GLM-5.3 responses leaked other customers' data, and the fault was Cloudflare's configuration and SGLang's engine, not the Chinese lab whose name sits in the model ID. Z.AI's shareholders wear the headline anyway.
Vincent Jiang · 3 min read
On October 26 Cloudflare+0.02% — Cloudflare, up 0.02 percent today disclosed that 155 responses served by GLM-5.3 on its Workers AI platform between August 27 and September 9 contained fragments of other customers' prompts and generations 1. The affected prompts were all longer than 681,280 tokens, which is to say the exposure sat entirely inside the million-token long-context regime GLM-5.3 is sold on 1. Gadi Evron, a researcher at security firm Knostic, found it first: he filed the bug through Cloudflare's HackerOne program on September 8, eleven days after the leaky configuration went live 1.
The fault is not where the outrage pointed it
The bug was two things Cloudflare owned outright. It deployed GLM 5.3 with a 1,048,576-token context window on a prefill KV cache pool of only 681,280 tokens, a mismatch it says it knew about before launch and did not enforce against 1.
And the open-source SGLang engine, which Cloudflare runs, silently swapped over-length prompts for a one-token placeholder, letting the decode node read stale cache pages still holding earlier users' data 12. GLM-5.3 is an open-weight release from Z.ai: Cloudflare downloaded the weights and served the model on its own GPUs 1.
The blame landed elsewhere anyway. BizPac Review, a conservative outlet quoting James Czerniawski of the Consumer Choice Center, wrote that "Z.ai had a poor configuration that allowed for the incidents to occur to begin with" 3. It did not. Cloudflare did. The same piece carries Ryan Fedusiak, a China and AI fellow at the American Enterprise Institute, calling Chinese-model APIs "the same problem we've had with TikTok, but scaled up to be 100 times worse" 3.
Cloudflare launched GLM 5.3 with a cache pool two-thirds the size of its context window
- Tokens
- Estimate
Data
| Tokens | |
|---|---|
| Advertised context window | 1,048,576 |
| KV pool at launch | 681,280 |
| KV pool after fix (estimate) | 2,040,000 |
Whose balance sheet eats it
For an open-weight lab, the model is the product and the isolation sits on someone else's hardware, but the name travels inside the model ID, on Cloudflare's catalog and on Amazon+1.83% — Amazon, up 1.83 percent today Bedrock alike 14. That matters for a company carrying roughly $142 million of first-half revenue, up around 400 percent, against a net loss near RMB 2 billion, on a market cap near $32 billion after an 81 percent fall from its June high 56.
The headline queue already has items in it. Anthropic$350B — Anthropic, private, latest valuation $350B found GLM's safeguards bypassed 63 to 100 percent of the time in October testing 7. The lab sits on the US Entity List and Texas's prohibited list 3, and every future host-side leak will be reported as a GLM leak, because the model ID is the only part of the stack a headline writer can name.
Watch two dates
AWS reports October 29, its first results since putting GLM 5.3 on Bedrock 4, and about 178 million Z.AI shares unlock in January 6. Z.AI holds no announced export registration, while MiniMax, the other listed Chinese lab, is already cleared to license models overseas 6. Which approval arrives first decides which story investors believe: the engine bug, or the lab 6.
Get Security by email, free
The breaches, flaws and security vendors AI is putting to the test. In our daily email, every weekday.
