🔍 Read the full analysis: How A Cache Leak And AI Spam Shaped Cloudflare’s Bug Hunting Challenge on ThorstenMeyerAI.com
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. A researcher reported the issue, and Cloudflare took the model offline before restoring a fixed version. Separately, a $1 million Firedancer audit contest and rising vulnerability-report volumes illustrate how AI-generated submissions can add work for security reviewers.
Cloudflare said its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a two-week period in August and September 2026. The company attributed the exposure to a mismatch in its memory configuration combined with a bug in the open-source SGLang inference engine; it took the model offline after confirming the incident and restored a fixed version later that day. The disclosure came as a separate audit contest illustrated a growing security-industry problem: AI-generated bug reports can increase the volume of submissions without reducing the work needed to verify them.
Cloudflare’s incident report, published October 26, says the affected endpoint was @cf/zai-org/glm-5.3, a hosted text-generation model. A security researcher reported on September 8 that very long prompts could sometimes produce text belonging to other users’ sessions. Cloudflare found 155 affected responses between August 27 and September 9, all associated with prompts longer than 681,280 tokens. The company said it found no evidence that someone deliberately exploited the flaw.
The incident involved two faults, according to Cloudflare. Its service advertised a context window of 1,048,576 tokens, although the relevant memory pool could hold only 681,280. A bug in SGLang’s handling of requests that exceeded that capacity allowed a rejected request to continue through a split processing setup. As a result, the decoding stage could read memory pages that had not been overwritten with the current request’s data. Cloudflare said such pages are not zeroed between requests, a performance practice that depends on correct memory management.
Cloudflare’s timeline says it began verification on the morning of September 9, declared an incident at 13:22 UTC and took the model offline 38 minutes later. It restored a fixed version that evening. The company also acknowledged a testing gap: it had checked response codes and engine performance at long context lengths but had not validated the output’s content and coherence.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in the handling of shared GPU memory can cross customer boundaries even when the model itself is not identified as the cause. For businesses sending code, documents or other sensitive material to hosted AI services, a response that includes another user’s text can create a confidentiality risk. Cloudflare’s finding that the affected requests appeared consistent with ordinary long-context use, rather than repeated exploitation, describes its assessment of the evidence; it does not change the fact that other customers’ data appeared in some responses.
The report also points to a testing challenge for providers running very long prompts. A successful HTTP response does not establish that the generated answer is safe or belongs to the right user. Cloudflare said it had not checked output content during its earlier long-context validation. For service operators, the incident highlights the need to test how systems behave when a request exceeds actual memory capacity, especially when work is split across processing stages.
The separate audit example shows a different pressure on security teams. Jump Crypto’s $1 million Firedancer contest received 809 reports from 162 researchers, which the company said reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission. The example is not evidence that all AI-assisted reports are low quality, but it illustrates how faster report production can shift the bottleneck from finding possible bugs to reviewing and confirming them.
Products Worth Considering
Anker SOLIX C200 DC Portable Power Station, 192Wh, 200W
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
The Leak and the Report Surge
Cloudflare’s account describes a disaggregated setup: one group of GPUs processes a prompt and builds its key-value, or KV, cache; another uses that cache to generate a response. The cache stores intermediate information from the prompt so the model does not need to recalculate it for every generated token. Cloudflare says the memory is divided into pages that requests borrow and return. In the affected configuration, a request that exceeded the pool’s capacity was rejected in one part of the system but was not properly treated as rejected by both queues in the split setup.
The problem had also been reported in the SGLang project before Cloudflare’s investigation. Cloudflare said it found an existing report, SGLang issue #30233, filed July 6, 2026, while looking into the incident. The company said it had not noticed that report earlier. The source material identifies the model as built by Z.ai and says the model itself was not at fault; the reported exposure arose from the service configuration and inference-engine behavior.
AI-generated security reports have drawn attention elsewhere, too. The source account cites curl ending its bug bounty in January 2026, Bugcrowd beginning to ban “submission farming” in March, and HackerOne recording 46,947 submissions in March 2026. That figure is a raw count in the cited material; it gives no comparison baseline that would support calculating a growth rate. Jump’s new bounty platform charges researchers 1 SOL per report, described by CoinDesk as about $100, a measure aimed at limiting low-value submissions.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
What the Incident Report Leaves Open
Cloudflare’s public report, as described in the source material, does not explain how affected customers were notified or provide a detailed account of what information appeared in each response. The 155-response figure is the company’s count; the material does not specify how many distinct customers were affected or whether all exposed text was sensitive. It also does not provide a complete account of the circumstances behind each affected response.
Cloudflare said the requests’ timing and volume looked consistent with normal long-context use and that it found no evidence of deliberate exploitation. That is the company’s conclusion based on its investigation, not proof that misuse was impossible. The source material also does not state whether the SGLang issue has since been fixed upstream or describe any additional independent review of the incident.
On the audit side, Jump’s belief that AI agents found or wrote nearly all contest reports is a company assessment. The cited figures do not separate reports written by AI from those assisted by AI, or establish how many unique findings were independently verified as valid vulnerabilities beyond the stated total of 127.
Further Disclosure and Review
Cloudflare says it restored a fixed GLM-5.3 version on the evening of September 9 after taking the service offline. The next questions for customers and security teams are whether the company will provide further details about notification and affected accounts, and whether it will publish additional information about safeguards or testing changes. No further public milestone is specified in the source material.
For AI-assisted vulnerability reporting, bounty programs and audit organizers are likely to keep adjusting review rules and submission costs as report volumes change. Jump’s 1 SOL charge is one stated response, while curl and Bugcrowd have taken different steps cited in the source account. Whether those measures reduce unhelpful submissions without discouraging valid findings remains to be seen.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare reported that 155 responses from its hosted model contained text from other customers’ requests between August 27 and September 9, 2026. The company traced the incident to a memory-capacity mismatch and a bug in SGLang’s handling of oversized prompts.
What kinds of prompts could trigger the leak?
Cloudflare said the affected prompts were longer than 681,280 tokens, the capacity of the relevant memory pool. The service advertised a larger context window of 1,048,576 tokens.
Did Cloudflare say the flaw was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the requests’ timing and volume as consistent with ordinary long-context use. That is the company’s assessment, and the report does not establish that deliberate misuse was impossible.
Why are AI-generated bug reports a concern?
AI tools can make it easier to produce security submissions, but reviewers still have to determine whether each report describes a real, distinct vulnerability. Jump Crypto said its contest received 809 reports that distilled to 127 unique findings, and believes AI agents found or wrote nearly every report.
Source: ThorstenMeyerAI.com
