Between August 27 and September 9, some responses from GLM-5.3 on Cloudflare Workers AI contained other customers' prompts and partial generations . Not a breach of a database, not a prompt injection — the inference engine itself served stale KV-cache pages from previous, unrelated requests , with a clean HTTP 200. Exactly 155 responses were affected, all triggered by prompts longer than 681,280 tokens . Cloudflare published the full autopsy yesterday. This post is the mechanism in four steps, why the same bug class may sit in other inference stacks, and a canary script that tests your own provider for cross-request leakage.

The detail that should stop you: 681,280 is 65% of 1,048,576 — the model's context window. Someone sized the KV pool at roughly two-thirds of the context and shipped it. Everything else follows from that one number.

The failure chain, step by step

From Cloudflare's disclosure , cross-checked against SGLang issue #30233 (open since July 6):

The mismatch.…