🔍 Read the full analysis: Why A Stranger’s AI Answer Became A Cloudflare Bug Hunting Story on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The disclosure also sits alongside a separate security-industry problem: AI-assisted reports are increasing the work needed to verify bug findings, though the two developments are not shown to be connected.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a 14-day period in August and September 2026. The company attributed the exposure to a configuration mismatch and a bug in the open-source SGLang inference engine; a separate security audit described in the source report shows how AI-written bug submissions are adding pressure to teams that investigate vulnerabilities.
Cloudflare’s incident report, published October 26, says the affected service was the hosted @cf/zai-org/glm-5.3 endpoint on Workers AI. The company traced the leak to prompts longer than 681,280 tokens. It said the 155 responses were observed from August 27 through September 9, excluding its own tests and the researcher’s requests.
The failure involved two faults, according to Cloudflare. Its prefill GPU pool had memory for 681,280 tokens, although the service advertised a 1,048,576-token context window. Separately, SGLang mishandled requests that exceeded the available memory in Cloudflare’s split prefill-and-decode setup. The decode side could read cache pages that prefill had not overwritten, exposing material from other sessions.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it declared an incident the next day, took the model offline 38 minutes later, and restored a fixed version that evening. The company reported no evidence of deliberate exploitation and said the affected requests appeared consistent with ordinary long-context use.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
A Model Leak Meets Report Overload
The Cloudflare disclosure is significant because it concerns cross-customer data exposure from a hosted AI service, rather than an incorrect answer generated from public information. The company says the issue was limited to very long prompts and returned in 155 responses, but its report does not specify what kinds of customer data appeared in those responses or how many customers were affected.
The separate audit story points to a different operational challenge. Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which it reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all the submissions, according to the source report. That does not establish a link to Cloudflare’s incident; it shows how AI can complicate the work of sorting useful vulnerability reports from duplicates or low-quality submissions.
Together, the accounts underline two distinct questions for security teams: whether AI services keep each customer’s data isolated, and whether the growing volume of AI-assisted reports can be reviewed reliably. In both cases, verification and safeguards matter alongside the speed AI tools can provide.
Products Worth Considering
HP Sprocket Panorama Portable Color Photo and Label Printer
FLEXISPOT 42-Inch Electric Height-Adjustable Desk Converter with Keyboard Tray
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
As an affiliate, we earn on qualifying purchases.
How Cache Pages Crossed Sessions
Cloudflare says its inference setup separated prompt processing, known as prefill, from answer generation, known as decode. The prefill stage stores a model’s intermediate calculations in a key-value, or KV, cache. That cache uses GPU memory allocated in fixed-size pages, which requests return for reuse after processing.
According to the incident report, those pages were not cleared between requests; the next request was expected to overwrite them. Cloudflare described that as a common performance practice. In the affected configuration, an oversized prompt was rejected and replaced with a one-token placeholder in prefill, while the decode queues checked whether a request had finished but not whether it had been rejected. Decode then read pages that had not been overwritten.
Cloudflare said it had known about the mismatch between the advertised context window and the prefill memory pool before launch. It expected the inference engine to return an error for prompts that did not fit. The company acknowledged that its long-context testing checked HTTP response codes and engine performance without validating output quality and coherence.
The source report also describes a separate AI-reporting pattern. Curl ended its bug bounty program in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions that month. These are distinct actions and figures; the source does not establish that the Cloudflare disclosure caused any of them.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
Customer Impact Still Undetailed
Cloudflare’s report gives a count of 155 affected responses, but does not state how many customers received them, what specific information appeared, or whether any customers were directly notified. The source material notes that the report does not explain how affected customers were told.
The company says it found no evidence of deliberate exploitation and that the traffic appeared consistent with routine use. That does not establish that every affected response was identified or that no recipient saw data from another session. The account provided here also does not independently verify Cloudflare’s investigation or disclose the full incident report’s supporting evidence.
The source material says the underlying SGLang issue had been reported as issue #30233 on July 6, 2026, and that Cloudflare became aware of it during its investigation. It does not provide details on the issue’s status beyond the fixes described in Cloudflare’s incident response. The Firedancer audit figures, meanwhile, do not establish how many reports were wholly generated by AI or independently verify Jump’s estimate that AI agents found or wrote nearly all of them.
Fixes and Disclosure Follow-Up
Cloudflare says it took the affected model offline after declaring an incident and restored a fixed version later that day. The information supplied does not give a further release date, a technical validation plan, or details of any continuing review. Readers should look for additional company updates on customer notification, the scope of exposed data, and measures to prevent the same failure in other models or configurations.
For the wider bug-reporting issue, the Firedancer contest’s figures and Jump’s proposed 1 SOL fee per submission illustrate one way a program may try to deter low-value reports, though the source does not establish the fee’s long-term results. The next useful evidence will be how security programs distinguish valid findings from AI-assisted volume while keeping reporting accessible to researchers.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch combined with a bug in SGLang.
Which prompts could trigger the leak?
Cloudflare says the affected responses were tied to prompts longer than 681,280 tokens, the capacity of the prefill GPU memory pool in the affected setup.
Did Cloudflare find evidence of an attacker exploiting the issue?
Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of affected requests as consistent with ordinary long-context use. That is the company’s assessment, not an independent confirmation.
How is the Firedancer audit story related?
The source presents it as a separate example of AI’s effects on security work, not as a cause or consequence of the Cloudflare incident. Jump Crypto said its contest received 809 reports that were narrowed to 127 unique findings and estimated AI agents found or wrote nearly all of them.
How many customers were affected, and were they notified?
The details provided do not say how many customers were affected or how Cloudflare notified them. The company reported 155 affected responses, but the number of responses does not establish the number of customers.
Source: ThorstenMeyerAI.com
