Not GP, but both. Exploiting the bug requires you to hit the same worker with multiple requests, which gets a lot easier if the number of workers is 1.