A long-context request returned another tenant’s data after every smoke test passed.

Cloudflare says 155 responses from its GLM 5.3 Workers AI deployment contained data from earlier customers’ requests between August 27 and September 9. Every affected prompt exceeded 681,280 tokens. The model advertised a 1,048,576-token context window, while the prefill KV pool held only 681,280 tokens. Cloudflare knew the capacities differed, but long-context tests returned HTTP 200 with streaming output. ¹

The failure crossed two nodes. SGLang rejected an oversized prompt and replaced it with a one-token placeholder so the batch could drain. Prefill transferred that one page and reported completion; decode had reserved pages for the original prompt and treated them as overwritten. It then attended to stale pages left by previous requests. A successful response therefore hid the isolation failure. ¹

Test the state boundary, not the status code. Operators using disaggregated SGLang should update to 0.5.22 or later, assert from the running engine that KV capacity covers the advertised context, and send canary-marked requests from separate tenants through rejection and abort paths. The acceptance check is that an over-capacity request fails before allocation or transfer and no marker from tenant A appears in tenant B’s output. Cloudflare says it now checks capacity directly and validated its fixes with the researcher’s reproduction and canary markers. ¹