🔍 Read the full analysis: Cloudflare’s Cache Leak And The Growing Noise Of AI Spam on ThorstenMeyerAI.com
Get audio and creator gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. A separate security-audit contest drew 809 submissions that Jump Crypto said largely appeared AI-generated or AI-assisted, highlighting how AI can raise both security risks and the workload of reviewing reports.
Cloudflare said October 26 that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a 14-day period, after a configuration mismatch combined with a bug in the open-source SGLang inference engine. The disclosure coincides with a separate signal of pressure on security review: Jump Crypto said an audit contest produced 809 reports but only 127 unique findings, with the company believing AI agents found or wrote nearly all of them.
Cloudflare’s report says the affected responses were generated between August 27 and September 9, and involved prompts longer than 681,280 tokens sent to the hosted @cf/zai-org/glm-5.3 endpoint. Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes returned text from other users’ sessions. Cloudflare said it found 155 affected responses, excluding its own tests and the researcher’s activity.
The incident involved two faults. Cloudflare advertised a 1,048,576-token context window, while the prefill GPUs’ memory pool for storing a request’s intermediate model data held only 681,280 tokens. SGLang mishandled prompts that exceeded the available capacity in Cloudflare’s split prefill-and-decode setup: the system could pass a rejected request onward, where the decode stage read memory pages that had not been overwritten. Cloudflare says those pages could still contain other customers’ prompts or partial responses.
Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening, according to the source report. The company said it found no evidence of deliberate exploitation. Separately, Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which the company narrowed to 127 unique findings. Jump’s view that AI agents found or wrote nearly every submission is a company assessment, not an independently established count.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI Security
The Cloudflare disclosure shows that a hosted AI service can expose customer data through failures in the infrastructure around a model, even when the model itself is not the source of the flaw. Here, the issue depended on memory allocation and request handling across two parts of the inference system. For users sending long prompts, the incident raises practical questions about how providers test isolation, validate outputs and respond when a request exceeds configured capacity.
The audit figures point to a different operational problem. AI tools can make it faster and cheaper to produce vulnerability reports, but the volume does not automatically translate into more useful findings. Jump’s 809 submissions became 127 unique findings, meaning reviewers still had to distinguish duplicates and assess the underlying claims. Together, the cases show security teams facing both the risk of AI systems leaking data and the extra work of evaluating AI-associated reports.
The available information does not establish that the two developments share a cause or direct connection. Their relevance is that they illustrate separate pressures on security practice: protecting data inside AI services and maintaining workable review processes as automated submissions grow.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Cache Capacity Failed
Language models store intermediate calculations for a prompt in a key-value cache, or KV cache, so the system can generate text without repeatedly processing the entire prompt. These data occupy GPU memory. Cloudflare says its cache pages were not cleared between requests; instead, the next request was expected to overwrite them, a practice the company described as common and useful for performance.
In Cloudflare’s setup, one GPU pool processed prompts and built the cache, while another generated responses. The advertised context length exceeded the prefill pool’s capacity. According to the incident report, the mismatch was known before launch, but Cloudflare expected oversized requests to return errors. Its long-context testing checked HTTP response codes and engine performance, not the correctness and coherence of generated output. The report also says a related SGLang issue had been filed on July 6, 2026, but Cloudflare noticed it only during its investigation.
The other development fits a wider pattern of strain on vulnerability-report programs. The supplied account says curl ended its bounty program in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those numbers describe different programs and measures; they do not by themselves show how many reports were valid or how much of the activity was AI-generated.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notice and Exposure Scope
Cloudflare’s report gives the count and date range of affected responses, but the supplied material does not say how affected customers were notified, whether the company has identified every customer whose text appeared, or what kinds of prompt content were involved. Cloudflare reported no evidence of deliberate exploitation, but that does not establish that every affected response has been identified or that no person saw the exposed text.
The exact content of all 155 responses and the number of distinct customers involved are not stated in the material provided. It is also unclear whether SGLang’s issue has been addressed across other deployments or whether additional safeguards have been adopted beyond the fixed Cloudflare version. For Jump’s contest, the exact share of reports generated or assisted by AI remains uncertain; the company’s estimate is not presented as a verified count.
Monitoring Fixes and Review Rules
Cloudflare says it restored a fixed model version the same evening it took the service offline. The next points for customers and security teams are whether Cloudflare provides further detail on notification and impact, and how it changes testing for oversized prompts and cross-request isolation. The supplied report does not give a date for a further update.
Jump’s new bounty platform requires researchers to spend 1 SOL per report, about $100 according to CoinDesk, as a way to discourage low-value submissions. How that fee affects valid reporting, participation and duplicate reports is not yet known. Security programs will also need to show whether new screening methods can reduce review work without blocking legitimate findings.
Key Questions
What happened in Cloudflare’s AI service?
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the incident to a capacity mismatch and an SGLang bug.
Which prompts could trigger the leak?
According to Cloudflare, affected requests were longer than 681,280 tokens, the capacity of the relevant prefill memory pool. The service advertised a context window of 1,048,576 tokens.
Did Cloudflare find evidence of an attack?
Cloudflare said it found no evidence of deliberate exploitation. Its report characterized the timing and volume of the requests, after excluding tests and researcher activity, as consistent with ordinary long-context use.
What does the Firedancer audit contest have to do with the leak?
The contest was a separate development, not a cause of the Cloudflare incident. It illustrates how security teams may face high volumes of reports associated with AI tools: Jump received 809 submissions and identified 127 unique findings.
What is still unknown about the Cloudflare incident?
The source material does not explain how affected customers were notified, how many distinct customers were involved, or what specific data appeared in the responses. Cloudflare’s report also does not establish whether related deployments elsewhere were affected.
Source: ThorstenMeyerAI.com
