On Workers AI, a GLM-5.3 configuration mismatch triggered an SGLang bug that exposed cached data pages across requests. OpenCode's Console breach exposed provider API keys for 1.4% of its users, and Cohere has put Confidential Computing into public beta on its managed inference platform. Builders should treat whoever serves their model or holds their API keys as part of their own security risk, not as a neutral pipe.
From the Field Notes:
- A configuration mismatch in GLM 5.3 on Workers AI triggered an SGLang bug that exposed KV cache pages across requests. (2026-10-27)
- iSec News: OpenCode says breach tied to distillation attack exposed provider API keys for 1.4% of Console users (2026-10-24)
- Cohere launched Confidential Computing on Model Vault in public beta. (2026-10-24)