🔍 Read the full analysis: Cloudflare’s AI Cache Leak: What Bug Hunters And Users Should Know on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The issue required prompts longer than 681,280 tokens and stemmed from a configuration mismatch combined with a bug in the SGLang inference engine. Separately, a Jump Crypto audit contest illustrates how AI-generated bug reports are burdening review teams, prompting a new fee for submissions.
Cloudflare says a bug in its hosted GLM-5.3 model caused 155 responses to contain text from other customers’ requests between August 27 and September 9, according to an incident report published October 26. The exposure affected prompts longer than 681,280 tokens and resulted from a Cloudflare configuration mismatch combined with a bug in the open-source SGLang inference engine.
A security researcher reported the issue to Cloudflare through HackerOne on September 8. Cloudflare’s report says the service’s advertised context window was 1,048,576 tokens, while the memory pool available to store prompt-processing data held 681,280 tokens. Requests that exceeded the pool should have failed, but the interaction between Cloudflare’s split processing setup and SGLang allowed some to continue.
Cloudflare says the affected responses contained data from other customers’ requests held in the model’s GPU memory cache. The company took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It says it found no evidence of deliberate exploitation. The report describes 155 affected responses across the incident period, but does not say how many customers were affected or how they were notified.
The same week also brought a separate sign of pressure on security review systems: Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which Jump reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all the submissions, according to the supplied source. Its new bounty platform charges researchers 1 SOL per report, about $100 according to CoinDesk. The two developments are distinct, but together show both the risks of AI infrastructure and the growing effort required to evaluate security reports.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Customer Data and Bug Triage
The Cloudflare incident highlights how a failure in infrastructure surrounding a model can expose user data even when the model itself is not the source of the defect. Here, cache accounting and request handling were central: memory pages from one request were not cleared before reuse, and the system did not stop a rejected oversized prompt from moving through its split processing pipeline.
For customers, the report establishes that some responses included other users’ text, but it does not establish the sensitivity of that text or the number of accounts involved. For providers, it points to a testing gap Cloudflare acknowledged: long-context checks measured successful HTTP responses and performance without checking that the generated output was coherent and isolated. The disclosure also underlines why security reports need timely, careful review, even as automated tools make it easier to produce large numbers of submissions.
The Firedancer contest provides a separate example of that review burden. A high report count did not translate into an equally high count of unique findings. Jump’s decision to charge for reports signals one response to suspected AI-assisted submission volume, though the source does not establish whether the fee will improve report quality or limit participation.
Products Worth Considering
Sonos Era 100 Wireless Smart Speaker, Black
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
Language models use a key-value (KV) cache to retain intermediate calculations from a prompt, avoiding the need to repeat that work as the model generates text. In Cloudflare’s setup, fixed-size memory pages were drawn from a shared pool. According to the company, those pages were not cleared between requests; the next request was expected to overwrite them. That approach can support performance, but it depends on the inference system correctly tracking which pages belong to each request.
Cloudflare ran the model in a disaggregated arrangement: one group of GPUs processed prompts and built the cache, while another group used the cache to generate answers. Cloudflare says its configuration allowed a context length larger than the available cache pool. SGLang treated an oversized prompt as rejected and substituted a one-token placeholder. But, in the split setup, queues checked whether processing had finished without checking whether it had been rejected. The decode side had reserved pages for the full prompt, while prefill wrote only the placeholder; the remaining pages could still contain other users’ prompts or partial generations.
Cloudflare says the client received an HTTP 200 response and a token count matching the long prompt, even though the returned content could include stale cache data. The company said it had tested long-context performance before launch but had not verified model output and coherence. It also said the underlying SGLang issue had previously been reported as issue #30233 on July 6, 2026, but Cloudflare did not notice it until investigating this incident.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
Affected Customers and Notice
Cloudflare’s report does not state how many customers were affected, what kinds of information appeared in the exposed text, or how the company contacted customers whose data may have been returned. It reports 155 affected responses, not 155 customers, and the source material does not establish that each response went to a different user.
The company says it found no evidence of deliberate exploitation, but that is not the same as proving no one attempted to trigger the flaw. The report’s account of requests being consistent with ordinary long-context use is Cloudflare’s assessment. The supplied material also does not provide independent verification of that assessment or describe any ongoing investigation into the earlier SGLang report.
For the Firedancer contest, Jump’s belief that AI agents found or wrote nearly every report is an attributed assessment, not a confirmed count of AI-generated submissions. It is also unclear from the supplied information how the new 1 SOL charge will be applied in practice or what effect it will have on the diversity and quality of reports.
Disclosure and Review Steps
Cloudflare has restored a fixed version of GLM-5.3, according to its report. The next questions for affected users are whether the company will provide more detail about notification, the scope and sensitivity of exposed text, and steps it has taken to prevent similar cache-handling failures. The available source material does not give a further public milestone or timetable.
Security teams and customers will also be watching how providers test long-context outputs, not just whether an endpoint returns a successful status code. On the bug-bounty side, Jump’s fee-based platform will provide a test of whether charging for submissions reduces low-value report volume without discouraging useful findings. No outcome from that policy is yet available.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses from its hosted model contained text from other customers’ requests between August 27 and September 9, 2026. The issue involved an oversized prompt, a cache-pool configuration mismatch, and a bug in SGLang.
What kind of prompts could trigger the leak?
According to Cloudflare, affected requests had to exceed 681,280 tokens, the capacity of the relevant memory pool. The model’s advertised context window was larger, at 1,048,576 tokens.
Did Cloudflare find evidence that someone deliberately exploited the flaw?
Cloudflare says it found no evidence of deliberate exploitation. Its report says the timing and volume of requests appeared consistent with ordinary long-context use; that conclusion is the company’s assessment.
How many customers were affected, and were they notified?
The report gives a count of 155 affected responses, but the supplied material does not say how many customers those responses involved or how they were notified.
Why is Jump Crypto charging for audit reports?
Jump’s Firedancer contest received 809 reports that it narrowed to 127 unique findings. Jump believes AI agents found or wrote nearly all of them and now charges 1 SOL per report; whether the fee improves report quality remains unclear.
Source: ThorstenMeyerAI.com
