# Cloudflare's GLM-5.3 KV Cache Exposure: What Happened and How to Respond

> Published 2026-10-27 · https://www.promptzone.com/ayaka_nkrumah/cloudflares-glm-53-kv-cache-exposure-what-happened-and-how-to-respond-348p

Cloudflare disclosed a critical security vulnerability in its Workers AI platform on May 27, 2025, where the **GLM-5.3 model exposed one user's KV cache to another**. The incident, [flagged in a detailed Hacker News discussion](https://blog.cloudflare.com/kv-cache-exposure-remediation/), was detected internally and remediated within hours, but highlights a novel risk in shared AI inference infrastructure.

> **Model:** GLM-5.3 (via Workers AI) | **Vulnerability:** Cross-request KV cache exposure | **Status:** Patched as of May 27, 2025
> **Affected:** Users of the GLM-5.3 model on Workers AI between May 24-27 | **License:** Proprietary (Cloudflare service)

## How the KV Cache Exposure Worked
The flaw was in the Key-Value (KV) cache, a standard performance optimization for large language models. For repeated prompt prefixes, the KV cache stores intermediate computations to avoid redundant processing. In Cloudflare's multi-tenant Workers AI environment, this cache was incorrectly shared **across different user requests and sessions**.

A user's prompt could trigger a cached computation from a previous, different user's request. This meant **sensitive data from one prompt could leak into the response of another**, potentially revealing fragments of private conversations, proprietary code, or personal information. The issue was specific to the GLM-5.3 model implementation and did not affect other models on the platform.


![Cloudflare's GLM-5.3 KV Cache Exposure: What Happened and How to Respond](https://promptzone-community.s3.amazonaws.com/uploads/articles/zjtlqerhzw3ghswmwodx.jpeg)

## Timeline and Scope of the Incident
Cloudflare's internal monitoring detected anomalous behavior on **May 27, 2025**. The engineering team identified the root cause and deployed a full mitigation **within four hours**. The vulnerable code was only in production from **May 24 to May 27**, a three-day window.

During this period, the GLM-5.3 model processed approximately **155 million requests**. Cloudflare's analysis concluded that **fewer than 500 requests** were potentially impacted by cache leakage. The company notified all customers whose requests were identified in the error logs.

{% details "Technical Deep Dive: KV Caching" %}
Key-Value (KV) caching accelerates LLM inference by storing the "key" and "value" matrices from the attention mechanism for initial tokens. When a new prompt shares a prefix with a cached prompt, the model uses the stored matrices instead of recomputing them. The vulnerability occurred because the cache namespace was not properly isolated by user session or request ID, allowing User B to access the cached computations from User A's prompt prefix. This is distinct from a data breach; no raw user data was stored, but the *output* of processing that data could be exposed.
{% enddetails %}

## Immediate Steps for Affected Developers
If you used the Cloudflare Workers AI GLM-5.3 model between May 24 and 27, 2025, you should take two actions. First, **review your application logs** for any anomalous or unexpected outputs from that period. Second, **check your email** for a notification from Cloudflare; they directly contacted users with potentially impacted requests.

For ongoing use, ensure you are using the patched service—no client-side update is required. The fix was applied server-side. Consider auditing your application's logging to ensure you capture full input/output pairs for future debugging and compliance needs.

## Security Comparison: Major AI Inference Platforms
This incident underscores the importance of tenant isolation in managed AI services. Below is how major platforms architect their security.

| Feature | Cloudflare Workers AI (Post-Fix) | AWS Bedrock | Google Vertex AI | Azure OpenAI |
|---------|----------------------------------|-------------|------------------|--------------|
| **Tenant Isolation** | Full process & cache isolation | Dedicated instances optional | Google Cloud project isolation | Azure AD tenant isolation |
| **Data Encryption** | In transit & at rest | In transit, at rest, optional customer keys | In transit, at rest, customer keys | In transit, at rest, customer keys |
| **Audit Logging** | Limited request logs | Comprehensive via CloudTrail | Integrated with Cloud Audit Logs | Integrated with Azure Monitor |
| **Pricing Model** | Pay-per-token | Pay-per-token + instance fees | Pay-per-token + compute | Pay-per-token |

The table shows that while all major providers encrypt data, isolation strategies vary. Cloudflare and Google use strong software-defined isolation within shared hardware, while AWS and Azure offer more expensive dedicated hardware options for the highest security tiers.

## Who Should Be Most Concerned?
This incident is a critical case study for **enterprise teams deploying LLM applications handling sensitive data**. If your use case involves private financial information, healthcare data (PHI), legal documents, or proprietary source code, you must evaluate your provider's isolation guarantees.

Developers building **high-throughput, multi-user applications** on shared inference endpoints should also review their architecture. The risk of cross-user contamination is lower for internal tools with a small user base but scales with public-facing apps.

> **Bottom line:** The exploit window was short and impact limited, but it reveals a shared-infrastructure risk that high-security applications cannot ignore.

## Pros and Cons of Cloudflare's Response
The disclosure provides a clear framework for assessing vendor reliability during a security event.

**Transparency and Speed:**
*   **Pro:** Cloudflare published a detailed post-mortem **within days** of the incident.
*   **Pro:** Mitigation was deployed in **under four hours** from detection.
*   **Pro:** They proactively identified and notified potentially affected users.

**Gaps and Questions:**
*   **Con:** The vulnerability existed for **three days** before detection.
*   **Con:** Workers AI’s audit logging is less comprehensive than enterprise competitors, making customer-side investigation harder.
*   **Con:** The post-mortem does not detail long-term architectural changes to prevent similar bugs in other models.

## The Bottom Line on AI Infrastructure Security
Cloudflare's rapid remediation sets a high bar for operational response, but the incident itself is a stark reminder. **AI inference is now critical infrastructure**, and its security model—particularly around performance optimizations like KV caching—is still being battle-tested. For now, enterprises with stringent compliance needs should pair any managed AI service with robust input sanitization, output auditing, and a fallback plan. The next industry standard will be providers offering verifiable, cryptographically-sealed tenant isolation.