--- title: "Cloudflare's own disclosure: 155 GLM-5.3 responses leaked other customers' data, and Z.AI's name travels" description: "Cloudflare disclosed that 155 GLM-5.3 responses leaked other customers' data, and the fault was Cloudflare's configuration and SGLang's engine, not the Chinese lab whose name sits in the model ID. Z.AI's shareholders wear the headline anyway." publisher: "The Inference" section: "Security" published: 2026-10-27T16:16:04.621Z modified: 2026-10-27T16:16:04.621Z canonical: https://theinference.org/article/cloudflare-s-own-disclosure-155-glm-5-3-responses-leaked-other-customers-data-and-z-ai-s-name-travels language: en keywords: "Cloudflare, Zhipu, Cybersecurity, AI Models" --- # Cloudflare's own disclosure: 155 GLM-5.3 responses leaked other customers' data, and Z.AI's name travels > Cloudflare disclosed that 155 GLM-5.3 responses leaked other customers' data, and the fault was Cloudflare's configuration and SGLang's engine, not the Chinese lab whose name sits in the model ID. Z.AI's shareholders wear the headline anyway. On October 26 [Cloudflare](https://theinference.org/markets/companies/cloudflare) [disclosed that 155 responses served by GLM-5.3 on its Workers AI platform](https://blog.cloudflare.com/kv-cache-exposure-remediation/) between August 27 and September 9 contained fragments of other customers' prompts and generations [1]. The affected prompts were all longer than 681,280 tokens, which is to say the exposure sat entirely inside the million-token long-context regime GLM-5.3 is sold on [1]. Gadi Evron, a researcher at security firm Knostic, found it first: he filed the bug through Cloudflare's HackerOne program on September 8, eleven days after the leaky configuration went live [1]. ## The fault is not where the outrage pointed it The bug was two things Cloudflare owned outright. It deployed GLM 5.3 with a 1,048,576-token context window on a prefill KV cache pool of only 681,280 tokens, a mismatch it says it knew about before launch and did not enforce against [1]. And the open-source SGLang engine, which Cloudflare runs, silently swapped over-length prompts for a one-token placeholder, letting the decode node read stale cache pages still holding earlier users' data [1][2]. GLM-5.3 is an open-weight release from Z.ai: Cloudflare downloaded the weights and served the model on its own GPUs [1]. The blame landed elsewhere anyway. BizPac Review, a conservative outlet quoting James Czerniawski of the Consumer Choice Center, wrote that "Z.ai had a poor configuration that allowed for the incidents to occur to begin with" [3]. It did not. Cloudflare did. [The same piece](https://www.bizpacreview.com/2026/10/24/americas-companies-keep-flirting-with-security-nightmare-thats-100-times-worse-than-tiktok-1664711/) carries Ryan Fedusiak, a China and AI fellow at the American Enterprise Institute, calling Chinese-model APIs "the same problem we've had with TikTok, but scaled up to be 100 times worse" [3]. *Chart: **Cloudflare launched GLM 5.3 with a cache pool two-thirds the size of its context window** Column chart comparing the 1,048,576-token configured context window with the 681,280-token prefill KV cache pool Cloudflare launched with and the roughly 2,040,000-token pool after the fix.* *Cloudflare's prefill KV cache held 681,280 tokens against GLM-5.3's 1,048,576-token context at launch; the corrected configuration holds about 2.04 million tokens. Tokens. Source: Cloudflare incident report, October 26, 2026. [1]* ## Whose balance sheet eats it For an open-weight lab, the model is the product and the isolation sits on someone else's hardware, but the name travels inside the model ID, on Cloudflare's catalog and on [Amazon](https://theinference.org/markets/companies/amazon) Bedrock alike [1][4]. That matters for a company carrying roughly $142 million of first-half revenue, up around 400 percent, against a net loss near RMB 2 billion, on a market cap near $32 billion after an 81 percent fall from its June high [5][6]. The headline queue already has items in it. [Anthropic](https://theinference.org/markets/companies/anthropic) found [GLM's safeguards bypassed 63 to 100 percent of the time in October testing](https://theinference.org/article/amazon-starts-selling-zhipu-s-glm-5-3-after-anthropic-found-its-safeguards-bypassed-63-to-100-of-the-time) [7]. The lab sits on the US Entity List and Texas's prohibited list [3], and every future host-side leak will be reported as a GLM leak, because the model ID is the only part of the stack a headline writer can name. ## Watch two dates AWS reports October 29, [its first results since putting GLM 5.3 on Bedrock](https://www.aboutamazon.com/news/company-news/amazon-q3-2026-earnings-preview) [4], and about 178 million Z.AI shares unlock in January [6]. Z.AI holds no announced export registration, while MiniMax, the other listed Chinese lab, is [already cleared to license models overseas](https://theinference.org/article/china-clears-deepseek-and-minimax-to-license-ai-abroad-while-150-billion-sits-in-the-red) [6]. Which approval arrives first decides which story investors believe: the engine bug, or the lab [6]. ## Takeaway Cloudflare's incident report pins the GLM-5.3 data leak on its own cache configuration and the SGLang engine, but with the model ID carrying Z.AI's name, every host-side failure lands on the Chinese lab's valuation. ## Sources 1. [Cloudflare Blog, Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang, 26 October 2026](https://blog.cloudflare.com/kv-cache-exposure-remediation/) 2. [LMSYS Org, SGLang security update: improving request isolation, 26 October 2026](https://www.lmsys.org/blog/2026-10-26-cf-security) 3. [BizPac Review (Daily Caller News Foundation), America's companies keep flirting with security nightmare that's '100 times' worse than TikTok, 24 October 2026](https://www.bizpacreview.com/2026/10/24/americas-companies-keep-flirting-with-security-nightmare-thats-100-times-worse-than-tiktok-1664711/) 4. [About Amazon, Some of Amazon's Q3 2026 announcements, from new devices to AI breakthroughs, October 2026](https://www.aboutamazon.com/news/company-news/amazon-q3-2026-earnings-preview) 5. [The Inference, Zhipu's RMB 1 billion physical AI fund is mostly Hangzhou's money, not Zhipu's, 22 October 2026](https://theinference.org/article/zhipu-s-rmb-1-billion-physical-ai-fund-is-mostly-hangzhou-s-money-not-zhipu-s) 6. [The Inference, China clears DeepSeek and MiniMax to license AI abroad while $150 billion sits in the red, 23 October 2026](https://theinference.org/article/china-clears-deepseek-and-minimax-to-license-ai-abroad-while-150-billion-sits-in-the-red) 7. [The Inference, Amazon starts selling Zhipu's GLM-5.3 after Anthropic found its safeguards bypassed 63 to 100 percent of the time, 6 October 2026](https://theinference.org/article/amazon-starts-selling-zhipu-s-glm-5-3-after-anthropic-found-its-safeguards-bypassed-63-to-100-of-the-time) --- Cloudflare's own disclosure: 155 GLM-5.3 responses leaked other customers' data, and Z.AI's name travels — The Inference. Canonical: https://theinference.org/article/cloudflare-s-own-disclosure-155-glm-5-3-responses-leaked-other-customers-data-and-z-ai-s-name-travels