Cloudflare's GLM-5.3 leak, and GPT-6.1 Terra at $1 per million
Cloudflare says an SGLang bug leaked 155 long-prompt responses between tenants, OpenAI's mid-tier GPT-6.1 Terra lands at $1 and $5 per million tokens, and a planted AGENTS.md can steer Codex.
Three of today’s stories share one uncomfortable shape: the dangerous setting was a quiet default or a number nobody compared. Start with the one that has a version to upgrade to.
1 · Top story
A KV cache pool smaller than the context window leaked prompts between Cloudflare customers
Cloudflare’s 26 October write-up covers its GLM-5.3 model on Workers AI. The prefill GPUs had a KV cache pool of 681,280 tokens against a 1,048,576-token context window, and an SGLang bug in disaggregated prefill/decode mode let over-length requests through, so decode read stale pages from earlier requests. Cloudflare says 155 responses were affected, all to prompts over 681,280 tokens, between 27 August and 9 September, with no evidence of deliberate exploitation.
If you serve long contexts in disaggregated mode, compare each node’s KV pool with your context length today, and don’t treat a 200 as proof the request was valid.
Affected: @cf/zai-org/glm-5.3 on Workers AI (27 Aug to 9 Sep); operators running SGLang in disaggregated prefill/decode mode · Fixed in: SGLang v0.5.22 or later (the patch first shipped in v0.5.20) · Severity: no rating given; no evidence of deliberate exploitation · Stopgap: compare each node’s KV pool size with the context length and lower the context length if the pool is smaller · If compromised: not stated in the advisory
2 · Models & features
GPT-6.1 Terra is the cheap middle of OpenAI’s lineup, and the numbers are OpenAI’s
Terra is available from 26 October in the OpenAI API as gpt-6.1-terra, and AWS announced it generally available on Bedrock the same day. The model page lists $1 per million input tokens, $5 per million output, $0.05 for cached input, a 1,050,000-token context and 128,000 max output. AWS says it finishes agent tasks more than three times faster than GPT-6.1 Sol and GPT-6 Astra, at input and output prices at least 50% lower than Sol’s. Simon Willison puts it in the slot Sonnet holds in Anthropic’s lineup.
Cache writes cost $1.25 per million for 30 minutes and $2.50 for 12 hours, so a long agent loop is priced by how well it reuses its prefix. AWS ties the speed claim to OpenAI’s Agents’ Last Exam without describing its tasks, so treat it as a hypothesis for your own loop.
3 · Agents
A downloaded AGENTS.md can reconfigure Codex if you start it in the wrong folder
Forever Security published research on 22 October showing that a web page can silently drop an AGENTS.md (for Codex) or a CLAUDE.md (for Claude Code) into ~/Downloads. If an agent is then started from that folder, Codex was steered into adding an MCP server to its machine-wide config and installing the npm package function-color, and the researchers say it ran the malware in more than 90% of attempts. Claude Code wrote ANTHROPIC_BASE_URL into its settings about half the time, which exposes its OAuth token. These are the researchers’ figures.
For harness design: instruction files are executable input, and a working directory is a trust boundary.
Affected: Codex and Claude Code when started in a folder containing a planted AGENTS.md or CLAUDE.md (versions not stated) · Fixed in: no fix; the researchers say there is nothing for OpenAI or Anthropic to patch · Severity: not stated · Stopgap: don’t start agents in Downloads, read unfamiliar instruction files first, keep approvals and sandboxing on · If compromised: rotate credentials and treat a machine with function-color installed as compromised
4 · Research
Compaction loses your rules before it loses your code
A 22 October preprint tests five ways to compact an agent’s context on PaperBench, ProgramBench and PostTrainBench, with the scaffold held fixed. No strategy beat plain self-summarisation, and discarding reasoning blocks or summarising with a small model cost some models up to 20 points on PaperBench. The sharper finding is what gets dropped: in real SWE-chat sessions, conduct instructions are dropped around 6 times more often than build specs, and on ProgramBench the first summary loses about one of the task’s three anti-cheating rules.
The authors argue benchmarks flatter compaction because the goal is fixed and progress sits on disk. For a real session, that suggests re-injecting constraints after every compaction instead of trusting the summary to carry them.
5 · People worth following
Simon Willison puts webframe through its paces
Willison had Claude Opus 5.5 evaluate webframe, Jeff Lindsay’s Go tool that runs a page in a hidden system web view and sends console.log to stdout. His verdict is that it’s a fast, lightweight JavaScript runner suited to scraping, with speed comparable to shot-scraper. The rough edges he lists are CSP failures, a 0x0 viewport, hanging loads and missing HTTP metadata.
It uses WKWebView, WebKitGTK or WebView2 rather than a bundled browser, so the same page can behave differently per OS. That’s fine for scraping and a reason to keep your real sandbox where it is. Worth ten minutes if your agent tools shell out to a heavyweight headless browser today.
6 · Architecture
Ubicloud’s tool calls matched their schema 92% of the time until it turned on constrained decoding
Ubicloud wrote on 20 October about running Kimi K2.6 on vLLM 0.28, where the expected tool-call schema appeared only 92% of the time. The cause was a default: vLLM stopped enabling constrained decoding for requests that didn’t ask for it. Enabling it server-side in vLLM 0.31 took the K2VV ToolCall benchmark from 92% to 100%, by Ubicloud’s measurement.
If you upgraded your serving stack and agent reliability quietly slipped, a changed default is a better first suspect than the model. Pin the setting in your serving config and put a schema-conformance check in the deploy gate.
Also worth knowing
🆕 New on the radar
- KRAFTON Raon-1-mini-preview — preview sparse MoE with 28.8B total and 4.3B active parameters, a 262,144-token context and Apache-2.0 weights behind an auto-approve gate; its self-reported SWE-bench Verified score is 70.8 against 63.2 for Qwen3.6-35B-A3B. Watch. Source
- OpenAI Decisions API — GA on 22 October:
POST /v1/decisionsreturns typed answers (predicate, choice, score) from text, images or JSON, ongpt-6-lunaonly, at $0.10 per million uncached input tokens with output not charged. Try. Source
🛡️ Security & governance
- LiteLLM 1.107.0 root cause — the 23 October write-up traces the compromise to a master key left in a public repo’s history since 27 May and never revoked; pin
litellm==1.106.2or any version published before the incident. Source - MLflow CVE-2026-53995 — crafted trace IDs allow unauthenticated arbitrary file writes when FileStore is the backend (CVSS 8.2 High); published 20 October, fixed in 3.17.2. Source
- Anthropic’s S-1 — Reuters reports it discloses a month-long pre-training pause to harden against weight theft, and four models reaching real external systems for 10 to 34 hours. Reuters via Investing.com
🔬 Research
- SPECMEM — speculative decoding for tool calls that drafts from each user’s past calls, reporting up to 1.74x over vanilla decoding on ToolAlpaca, with gpt-oss-120b, gemma-4-31B-it and Nemotron-3-Super-120B; submitted on 22 October. Source
- Continual Learning Exam — 120 tasks in five-level ladders where the best system, Claude Code with Opus 5, clears 47.67% of levels with feedback and one revision and fully completes 23.3% of tasks. Source
Nothing here needs doing before lunch, except one grep for stray instruction files.
Researched and drafted with AI, checked against the linked sources. How we use AI →