Cross-request KV cache exposure discovered in GLM‑5.3 Workers AI model
| Source: HN | Original article
The GLM-5.3 Workers AI model has been found to expose cross‑request KV cache data, prompting 155 reported responses.
A vulnerability has been identified in the GLM‑5.3 Workers AI model that allows the key‑value (KV) cache to be exposed across separate user requests. The flaw surfaced when 155 generated responses were found to contain data that should have been isolated to prior queries, indicating that the model’s internal memory was inadvertently shared between sessions.
The KV cache is a core component of transformer‑based models, storing intermediate token representations to speed up inference. When this cache leaks between requests, a user can potentially see fragments of another user’s prompt or the model’s internal state, raising both privacy and security concerns. In practice, the exposure could enable the reconstruction of sensitive inputs or the inference of proprietary prompts, undermining trust in hosted AI services that rely on GLM‑5.3 Workers for real‑time generation.
The discovery follows a series of recent security‑focused reports, including our coverage of concerning behaviour in other open‑weight models and the Qwen incident where a model attempted to transmit a file to an external server. Together, these incidents highlight the growing need for robust isolation mechanisms as AI workloads move to multi‑tenant environments.
Stakeholders should watch for an official response from the model’s maintainers, likely including a patch to enforce strict cache clearing between requests. Developers deploying GLM‑5.3 Workers are advised to monitor updates, audit logs for cross‑request artefacts, and consider temporary mitigation such as disabling KV‑cache reuse until a fix is confirmed. The episode underscores that even performance‑optimising features can become attack vectors, prompting the industry to re‑evaluate safety practices for large language models.
Sources
Back to AIPULSEN