🔍 Read the full analysis: From AI Answer Leak To Spam Flood: A Cloudflare Bug Hunter Story on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says a configuration mismatch and an SGLang bug caused 155 responses from its hosted GLM-5.3 model to include text from other customers’ requests between August 27 and September 9, 2026. The same week’s bug-bounty debate centered on a separate Jump Crypto audit, where 809 submissions became 127 unique findings and Jump said AI agents were behind nearly all reports. The two developments point to different parts of AI security: preventing system failures and reviewing a growing volume of submissions.
Cloudflare said October 26 that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a 14-day period, after a configuration mismatch and an inference-engine bug combined to mishandle extremely long prompts. The disclosure appeared alongside a separate security-industry concern: Jump Crypto said an audit attracted hundreds of reports that it believes were largely produced or found by AI agents, underscoring the rising cost of validating vulnerability submissions.
Cloudflare’s incident report says the affected responses occurred between August 27 and September 9, and involved prompts longer than 681,280 tokens. The company attributed the leak to two faults: its prefill GPU memory pool could not hold the full context advertised for the model, and the open-source inference engine SGLang did not properly stop rejected requests in Cloudflare’s split prefill-and-decode setup. GLM-5.3 is a model from Z.ai; Cloudflare’s account identifies its service configuration and inference path, rather than the model itself, as the source of the incident.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it declared an incident the following day, took the model offline 38 minutes after that declaration, and restored a fixed version later that evening. It said its review found no evidence of deliberate exploitation. After excluding its own tests and the researcher’s requests, Cloudflare said the remaining activity was consistent in timing and volume with ordinary long-context use.
The separate audit example in the source account concerns Jump Crypto’s $1 million Firedancer contest. It received 809 submissions from 162 researchers, which were narrowed to 127 unique findings. Jump believes AI agents found or wrote nearly every submission, according to the account. In response, its new bounty platform requires researchers to spend 1 SOL per report; the source describes that amount as about $100, citing CoinDesk. These figures concern a different program and are not evidence that AI caused the Cloudflare leak.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on AI Security
The Cloudflare incident shows how a failure in infrastructure around a model can expose information even when the model itself is not identified as the cause. In this case, requests that exceeded available cache capacity were supposed to be rejected. A flaw in how the separated processing queues handled those requests allowed decoding to read cache pages that still held other users’ text. The episode puts tenant isolation, error handling and output testing at the center of operational security for hosted AI services.
The bug-report figures point to a different pressure: security teams must distinguish useful findings from a much larger volume of submissions. A contest with 809 reports but 127 unique findings illustrates the review burden Jump faced, though the source does not provide an independent count of how many reports were generated by AI. Fees may discourage low-quality or repetitive entries, but they can also affect who is able to submit reports. The two stories together show that AI can be part of both the system being secured and the process used to find flaws.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Language models store intermediate calculations for a prompt in a key-value cache, or KV cache, so they do not need to recalculate the full prompt for every generated token. Cloudflare says its cache pages are not cleared between requests; the next request is expected to overwrite the pages it receives. That approach can reduce overhead, but correct allocation and request handling must prevent one customer’s pages from being read by another.
Cloudflare described a context limit of 1,048,576 tokens alongside a prefill cache pool sized for 681,280. The company said it expected the inference engine to return an error for requests that did not fit, and that its pre-launch long-context checks focused on HTTP status codes and engine performance rather than validating generated output and coherence. According to its report, SGLang marked an oversized request as rejected and replaced it with a one-token placeholder. In the disaggregated setup, the queues checked whether requests had finished but not whether they had been rejected. The decode stage then read pages that prefill had not overwritten.
The source account says the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, and Cloudflare noticed it during its own investigation. It also describes a broader rise in security-submission volume: curl ended its bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those are separate developments cited by the source, not measures of the Cloudflare incident.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its October 26 incident report
Customer Notice and Exposure Scope
Cloudflare’s report, as summarized in the source material, does not say how affected customers were notified, whether every affected response was identified, or what text appeared in each response. The report gives the count of 155 responses and the prompt-length threshold, but the material does not provide a customer count or a detailed account of the information contained in the exposed text.
Cloudflare said it found no evidence of deliberate exploitation, but that statement is the company’s assessment, not proof that no one tried to trigger the behavior. The source does not describe an independent review of the incident. Details of the fix and any broader review of other models or configurations are also not provided here. For the Jump Crypto contest, the source reports Jump’s view that AI agents were responsible for nearly every submission, but does not provide an independent breakdown or explain how that attribution was established.
Follow-Up on Fixes and Reports
The immediate next step for Cloudflare is to give customers and the public a clearer account of notification, scope and remediation, including what information appeared in affected responses and whether similar configurations were checked. The company said it restored a fixed version on the evening of September 9; the source material does not name a later review date or additional technical milestones.
For security programs, Jump’s per-report fee is one response to the challenge of reviewing high submission volumes. Whether it improves the proportion of actionable findings without discouraging legitimate researchers remains to be seen. More detail from contest organizers about validation methods and the role attributed to AI tools would help clarify how these programs are adapting. The Cloudflare report and the audit figures are separate cases, and no direct link between them has been established.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare said 155 responses from its hosted model contained text from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a cache-capacity mismatch and an SGLang request-handling bug.
Was the GLM-5.3 model itself identified as the cause?
No. Cloudflare’s report, as described in the source material, points to Cloudflare’s service configuration and the inference engine. GLM-5.3 is a model from Z.ai, but the account does not blame the model itself.
Did Cloudflare say an attacker deliberately exploited the issue?
Cloudflare said it found no evidence of deliberate exploitation. It described the remaining requests, after excluding its tests and the researcher’s, as consistent with ordinary long-context use. That is the company’s assessment.
What did the Jump Crypto audit show?
The Firedancer contest received 809 reports from 162 researchers, which were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all of them, and its new bounty platform charges 1 SOL per report, according to the source account.
What remains unknown about the Cloudflare exposure?
The source material does not say how affected customers were notified, how many customers were involved, or what specific text appeared in the responses. It also does not provide an independent assessment of the company’s finding that there was no evidence of deliberate exploitation.
Source: ThorstenMeyerAI.com
