A tenant‑isolation flaw in Cloudflare’s Workers AI GLM‑5.3 model exposed 155 customer responses between 27 August 2026 and 9 September 2026. The leak occurred when prompts exceeded 681 280 tokens, a size larger than the prefill KV‑cache pool (681 280 tokens) but smaller than the model’s 1 048 576‑token context window. SGLang’s disaggregated prefill/decode flow mishandled over‑length requests: the scheduler rejected the prompt, substituted a one‑token placeholder, and marked the request as unfinished, allowing it to pass the prefill admission queue. Prefill generated KV for the placeholder and transferred a single page to decode, while decode retained the original eight‑page reservation and read stale cache pages containing other users’ data, returning coherent but contaminated replies. Cloudflare fixed the configuration by resizing the KV pool to ~2.04 million tokens (≈2× context) and applied an engine patch that retires rejected requests before any KV transfer and validates token‑count matches. Additional hardening includes deferred KV release, bounded Mooncake transfer batches, and stricter deployment checks that compare pool size to context length. The model was taken private on 9 September, rebuilt with the corrected config and patches, and restored at 19:40 UTC. All other Workers AI models were unaffected, and operators are advised to upgrade to SGLang v0.5.22+, enforce pool‑size checks, enable deferred release, bound transfers, and activate checksum‑based integrity verification.