Cloudflare Workers AI Bug Exposed Fragments of Other Customers' Data via GLM-5.3

·2 views

Between August 27 and September 9, 155 responses from the GLM-5.3 model on Cloudflare's Workers AI platform leaked fragments of other customers' requests. All affected responses involved prompts exceeding 681,280 tokens, which was less than the model's advertised roughly one-million-token context window. The cause was a mismatch between the advertised context length and the GPU key-value cache capacity, combined with SGLang's disaggregated serving path failing to abort over-length prompts and instead generating from stale cache data. Security researcher Gadi Evron reported the issue on September 8, and Cloudflare reproduced it, pulled the model, deployed a fix, and restored service the same day. Cloudflare then worked with SGLang maintainers on upstream fixes and published a postmortem acknowledging its own errors.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DocuMorph Turns Code and API Specs into Living 3D Architecture Docs

DocuMorph is an open-source tool designed to stop architecture documentation from falling out of date as code changes. It converts code, GitHub links, and API specifications into interactive documentation offering both a 3D WebGL constellation view and a 2D canvas that users can switch between. Developers can run an embedded API sandbox directly from service and endpoint nodes, and inspect code with a Monaco editor and simulated telemetry. The ingestion pipeline includes safeguards such as SSRF and private-IP blocking, rate limiting, and input sanitization. Documentation can be exported as OpenAPI 3.1, JSON Schema, or Markdown, and the project is positioned for Hacktoberfest 2026.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Premultiplied Alpha Resizing Affects Edge Colour in Cut-Out Thumbnails, Tests Show

A developer testing a thumbnail pipeline that shrinks cut-out PNGs asked whether premultiplying RGB by alpha before resizing matters. Using two AI cut-outs from Wikimedia Commons photos, a portrait and a white dog, they shrank and re-enlarged each image with and without premultiplication. Alpha values were identical either way, so the softer edge comes from interpolation shared by both methods, while the RGB beneath the edge is what changes. The portrait showed substantial edge colour error, with pale fringing, whereas the dog showed much smaller differences, because the colours hidden under its transparent edge differed. The author notes that two images cannot establish how typical files behave, and that other scalers and browser APIs produced varying results.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Hosted Family Data Can Become Inaccessible After Owner's Death Without Succession Planning

An article warns that personal servers holding family photos, legal papers, and archives can become unreachable when their sole administrator dies. Without documented credentials or a handover plan, relatives without technical skills may be unable to operate the system or decrypt its contents. The piece notes that unlike major cloud providers, which offer legacy-access features, self-hosted setups lack automatic safeguards, so expiring domains and failing hardware can compound the problem. It recommends shared credential vaults, automated off-site backups, and written succession plans to protect irreplaceable data.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Necro-Shell: A Local LLM Terminal Wrapper That Comments on Your Commands

Necro-Shell is a terminal wrapper built for the Hacktoberfest Open-Source AI Challenge that turns a standard command-line interface into a horror-themed experience. It runs a local, open-weight language model to observe each command the user types and produces unsettling, context-aware commentary before the command executes. Examples include mourning deleted files on rm, asking about the user's location on cd, and mocking attempts to gain administrator access via sudo. The project runs locally through Ollama with the llama3 model and requires the requests Python package. It is presented as a playful, interactive take on the idea of a 'ghost in the machine.'

0 comments Read more at DEV Community