How a Pool Size Mismatch Leaked 155 LLM Responses Across Tenants
Cloudflare disclosed a cross-tenant KV cache exposure in its Workers AI GLM-5.3 deployment: 155 responses contained data from other customers' requests. The root cause was two overlapping bugs—an undersized KV pool that was flagged before launch and dismissed, plus an SGLang flaw that had been reported upstream months earlier. The incident is a useful case study in how LLM inference infrastructure fails differently than traditional web backends.
Read more →