Cloudflare's GLM-5.3 leaked other users' prompts through its KV cache. I rebuilt the bug in 30 lines.
Cloudflare's Oct 26 disclosure: a KV pool 367k tokens short of the context window plus a rejection path that lied turned 155 GLM-5.3 responses into other users' data. I rebuilt the mechanism and measured the leak: 99.2% stale context.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.