Cross-request KV cache exposure in the GLM-5.3 Workers AI model
27 October 2026 · filed under 95d5916fd628
A Cloudflare blog post, titled “Cross-request KV cache exposure in the GLM-5.3 Workers AI model,” addresses a flaw in the key-value cache handling of the GLM-5.3 model as deployed on Cloudflare’s Workers AI platform. The post, discussed in a Hacker News thread drawing 155 responses, concerns remediation of the exposure.
The key-value cache is a component of transformer-based language models that stores intermediate attention computations to speed up inference across a session. A cross-request exposure of this kind would mean that cache contents from one request could, under some circumstance, become accessible in the context of a different request, a pattern that would blur the isolation boundary users expect between separate inference calls on shared infrastructure.
The supplied material does not specify the technical mechanism of the exposure, the scope of affected users or data, the timeline of discovery, or the remediation steps taken. Those details, along with any account of how the issue came to be identified, would require consultation of the Cloudflare post itself, published at blog.cloudflare.com/kv-cache-exposure-remediation.
The Hacker News discussion thread’s content, including the substance of its 155 responses, is not characterized in the supplied material beyond its existence and volume.