🔍 Read the full analysis: AI Spam And A Cache Leak Complicate Cloudflare Bug Hunting on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between Aug. 27 and Sept. 9, 2026. The incident coincided with a separate sign of pressure on security review: Jump Crypto says AI agents likely found or generated nearly all reports in a large bug bounty contest, prompting a fee for submissions.
Cloudflare disclosed Oct. 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests during a 14-day period in August and September. The incident stemmed from a mismatch in Cloudflare’s cache configuration combined with a bug in the open-source SGLang inference engine, while a separate bug bounty contest illustrates how AI-generated reports are adding work for security reviewers.
Cloudflare said the affected requests were made to its Workers AI GLM-5.3 endpoint from Aug. 27 through Sept. 9. The leak could be triggered only by prompts exceeding 681,280 tokens. Cloudflare’s incident report said it found 155 affected responses; after excluding its own tests and the researcher’s, it described the remaining requests as consistent in timing and volume with ordinary long-context use, rather than repeated exploitation.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on Sept. 8. Cloudflare said it declared an incident at 13:22 UTC the next day and took the model offline 38 minutes later. It restored a fixed version that evening and said it found no evidence of deliberate exploitation. The report attributes the leak to a configuration that allowed a context window of 1,048,576 tokens despite a prefill cache pool sized for 681,280, alongside an SGLang bug that allowed rejected requests to proceed through a split processing system.
The disclosure appeared alongside a distinct bug-hunting problem. Jump Crypto’s $1 million Firedancer audit contest attracted 809 submissions from 162 researchers, which were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission, according to the source report. Its new bounty platform charges researchers 1 SOL per report, about $100 at the rate cited by CoinDesk, in an effort to discourage low-quality submissions.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
AI Raises Costs for Security Review
The Cloudflare incident shows how a failure in infrastructure around a model can expose information across customer sessions, even when the model itself is not identified as the source of the defect. Cloudflare’s account points to cache allocation and request handling as the failure points. For customers using hosted AI systems with long prompts, the episode underscores that privacy depends on the serving stack as well as the model.
The contest figures point to a separate challenge: AI tools can make it cheaper and faster to generate vulnerability reports, but the work of confirming whether each report is valid remains with security teams. Jump’s fee is one response to that imbalance. Other organizations have also adjusted their programs: the source report says curl ended its bounty program in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. These figures indicate more review pressure, but they do not establish that every increase is caused by AI.
Products Worth Considering
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
Jackery HomePower 3600 Plus Portable Power Station, 3584Wh, 3600W
DJI Osmo Mobile 8 Gimbal with Mic Mini Transmitter, Infinity Black
As an affiliate, we earn on qualifying purchases.
How the Cache and Queue Failed
Language models use a key-value cache, or KV cache, to store intermediate calculations from a prompt so the system can generate later text without processing the entire prompt again. Cloudflare said its system did not clear cache pages between requests; instead, the next request was expected to overwrite them. That practice can support performance, but it relies on correct allocation and tracking to prevent one request from reading another’s data.
Cloudflare described its GLM-5.3 deployment as a disaggregated setup, with one GPU pool processing prompts and building the cache, and another generating responses. For prompts too large for the configured pool, SGLang marked the request rejected and replaced it with a one-token placeholder. Cloudflare said queues in the two-stage system checked whether a request had finished, but not whether it had been rejected. The decode stage then read pages that prefill had not overwritten, exposing material left by other requests.
Cloudflare said it had known about the context-window and cache-pool mismatch before launch. It expected oversized prompts to return an error and said its long-context checks focused on HTTP status codes and engine performance, without checking output content and coherence. The company also said it noticed during the investigation that the SGLang issue had been reported publicly as issue #30233 on July 6, 2026.
““The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.””
— Cloudflare incident report
Scope and Customer Notification
Cloudflare’s report identifies 155 affected responses, but the source material does not give the number of customers or explain how the affected customers were notified. It also does not provide a complete account of what information appeared in each response. Cloudflare said it found no evidence of deliberate exploitation; that is the company’s finding, not proof that every request was understood or attributable.
The available account does not state whether SGLang has since changed its handling of rejected requests, or whether Cloudflare has made broader changes to testing and cache isolation beyond fixing the affected model version. The contest figures also do not establish how many submissions were fully AI-generated versus AI-assisted, or how many were incorrect or duplicated beyond the reported reduction to 127 unique findings.
Follow-Up on Fixes and Triage
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of Sept. 9 after taking the model offline. The supplied incident account does not set out a further public review date or describe additional remediation milestones. Readers and customers will be looking for more detail on customer notification, the scope of exposed text and any safeguards added to prevent rejected requests from reaching the decode stage.
Jump’s per-report charge marks a change in how its new platform filters submissions, while other bounty programs are also responding to volume. Whether fees and anti-farming rules improve the ratio of useful findings to review effort remains to be seen. The central test for both developments is whether organizations can validate reports and isolate customer data reliably as AI makes both security research and report production easier to scale.
Key Questions
What data did Cloudflare say was exposed?
Cloudflare said 155 responses contained data from other customers’ requests. Its report, as described in the source material, does not specify the number of affected customers or detail the contents of each response.
What caused the GLM-5.3 cache leak?
Cloudflare attributed it to a cache-pool configuration mismatch and an SGLang bug. Oversized requests were marked rejected but passed through queues that did not check their rejection status, allowing a later stage to read cache pages that had not been overwritten.
Did Cloudflare find evidence of an attack?
Cloudflare said it found no evidence of deliberate exploitation. It characterized the remaining affected requests as consistent with ordinary long-context use, while the full circumstances of every request are not detailed in the supplied material.
Why is Jump Crypto charging for bug reports?
Jump’s Firedancer contest received 809 reports that were reduced to 127 unique findings, and Jump believes AI agents found or wrote nearly every report. Its new platform charges 1 SOL per submission, about $100 at the rate cited by CoinDesk, to deter low-quality or excessive reports.
Source: ThorstenMeyerAI.com
