🔍 Read the full analysis: When AI Spam Drowns Out The Hunt For Cloudflare Bugs on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare says a configuration mismatch and an SGLang bug caused 155 responses from its hosted GLM-5.3 model to include data from other customers’ requests between August 27 and September 9, 2026. In a separate example of pressure on security teams, Jump Crypto says 809 submissions to a Firedancer audit contest yielded 127 unique findings, with AI agents involved in nearly all reports in its view.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a two-week period in August and September. The incident, caused by a configuration mismatch combined with a bug in the SGLang inference engine, comes amid a separate surge in AI-assisted vulnerability submissions that is making it harder for security teams to identify useful reports.
Cloudflare’s report says the issue affected requests to its Workers AI GLM-5.3 endpoint from August 27 through September 9. Only prompts longer than 681,280 tokens could trigger the problem. Security researcher Gadi Evron of Knostic reported it through Cloudflare’s HackerOne program on September 8, saying some very long prompts sometimes returned text from other users’ sessions.
The company traced the incident to two faults. Its advertised context window was 1,048,576 tokens, larger than the available key-value cache pool, which held 681,280 tokens. Separately, SGLang mishandled requests that exceeded that pool in Cloudflare’s split prefill-and-decode setup. The decode side could read cache pages that the prefill side had not written for that request, leaving material from earlier users available in the response.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It reported no evidence of deliberate exploitation. The company also said the affected requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to trigger the flaw. It acknowledged that its pre-launch checks tested response codes and engine performance at long context lengths but did not validate generated output and coherence.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why AI Service Isolation Matters
The incident shows how a failure in the inference system around a model, rather than in the model’s learned behavior, can expose customer data. The cache held intermediate information used to generate responses, and correct separation between requests depended on the engine and service configuration tracking which memory pages belonged to each request.
For customers using hosted models with long-context prompts, the disclosure raises practical questions about whether a service’s advertised limits match its tested operating conditions and what safeguards apply when a request exceeds available resources. Cloudflare’s report describes a narrow trigger condition and says it found no evidence of intentional exploitation; it does not establish that every long-context user was affected.
The audit-contest example points to a different but related operational pressure. AI can lower the cost of producing reports, but security teams still have to review and validate them. If submissions multiply faster than confirmed findings, attention can be diverted from credible vulnerabilities—including issues in systems that handle sensitive data.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Two Pressures on Security Teams
The report describes a key-value cache as memory holding intermediate calculations from a prompt so a model can generate subsequent text without processing the entire prompt again. Cloudflare said cache pages were not cleared between requests; the next request was expected to overwrite them. That approach can support performance, but it requires accurate allocation and handling of every page.
In this case, Cloudflare’s prefill GPUs processed a prompt and prepared cache data, while separate decode GPUs generated the answer. The two sides did not handle the oversized request consistently: one rejected it and replaced it with a one-token placeholder, while the other had reserved cache capacity for the full prompt. Cloudflare said the resulting response could be returned with HTTP 200 and a token count matching the long prompt. The bug had previously been reported to SGLang as issue #30233 on July 6, 2026; Cloudflare said it noticed that report during its investigation.
The submission-flood example comes from Jump Crypto’s $1 million Firedancer audit contest. The source report says 809 submissions from 162 researchers amounted to 127 unique findings. Jump believes AI agents found or wrote nearly every submission, and its new bounty platform charges 1 SOL per report, described by the source as about $100. The report also cites curl ending its bounty in January, Bugcrowd introducing a ban on “submission farming” in March, and HackerOne recording 46,947 submissions in March 2026. These are separate developments, not evidence that AI-generated reports caused Cloudflare’s incident.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Questions the Incident Report Leaves
Cloudflare’s report does not say how affected customers were notified, or provide a detailed account of what data appeared in the 155 responses. The source material also does not identify the customers or say whether all affected responses were viewed by users. Cloudflare’s statement that it found no evidence of deliberate exploitation is not proof that no one attempted to trigger the flaw.
The exact volume of customer information exposed is also not stated. The report says the responses contained data from other users’ requests, but the supplied details do not quantify the content or identify how many separate customers were involved. The stated 155 figure refers to affected responses, not necessarily 155 customers.
For the Firedancer contest, the source gives Jump Crypto’s view that AI agents found or wrote nearly every submission, but does not describe the method used to determine AI involvement. The figures show the difference between total submissions and unique findings; they do not establish how many reports were false, how much review time they consumed, or whether the new fee will improve the quality of reports.
Fixes and Triage Measures
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it took the service offline. The supplied report does not specify what further changes it plans for long-context testing, cache isolation, or customer notification. Readers should look to any later company update for those details and for clarification of the affected data and users.
The source material says Jump Crypto’s new bounty platform now requires a 1 SOL payment per report. Its effect on submission volume and verified findings has not yet been reported. More broadly, the examples leave security organizations weighing ways to filter low-value submissions without discouraging researchers who find genuine flaws.
Key Questions
What happened to Cloudflare’s hosted AI model?
Cloudflare said its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a cache-capacity mismatch and a bug in SGLang.
Which requests could trigger the leak?
According to Cloudflare, the issue could be triggered only by prompts longer than 681,280 tokens. The report does not say that all requests at or below that length were affected.
Did Cloudflare find evidence of deliberate exploitation?
Cloudflare said it found no evidence of deliberate exploitation and described the requests as consistent with ordinary long-context use. That is the company’s reported finding; it does not establish that no exploitation attempt occurred.
What does the Firedancer contest have to do with the incident?
It is a separate example of AI’s effect on security work. Jump Crypto’s contest received 809 submissions that amounted to 127 unique findings, while Cloudflare’s disclosure concerns a data leak in an AI service. The source does not connect the two events causally.
Source: ThorstenMeyerAI.com
