🔍 Read the full analysis: How AI Answers And Cache Errors Can Cross Session Lines on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. A separate Jump Crypto audit contest drew 809 submissions but produced 127 unique findings, highlighting the growing cost of reviewing AI-assisted security reports.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing material from other customers’ requests over a 14-day period in August and September. Its October 26 incident report attributes the exposure to a configuration mismatch and a bug in the SGLang inference engine; a separate Jump Crypto audit contest that week showed how AI-generated security submissions are also increasing the burden on reviewers.
Cloudflare says the affected service was Workers AI’s hosted GLM-5.3 endpoint, a text-generation model from Z.ai. The responses occurred between August 27 and September 9, and only on prompts longer than 681,280 tokens. Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it found 155 affected responses after excluding its own testing and the researcher’s requests.
The incident report describes two faults that combined. Cloudflare configured a 1,048,576-token context window while the prefill GPUs’ memory pool could hold only 681,280 tokens. A bug in SGLang then allowed requests that could not fit to proceed through a split prefill-and-decode system. The decode stage had reserved cache pages for the full prompt, while prefill wrote only a placeholder; the remaining pages still contained other requests’ data.
Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The company said it found no evidence of deliberate exploitation. Separately, Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which the company said represented 127 unique findings. Jump believes AI agents found or wrote nearly all the reports, according to the source account.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The Cloudflare incident shows how a failure in infrastructure around a model can expose information even when the model itself is not at fault. In this case, GPU memory bookkeeping was meant to keep one request’s intermediate data separate from another’s. The two configuration and software faults together broke that boundary for some oversized prompts.
For customers using hosted AI to process code or other sensitive material, the episode raises practical questions about isolation between sessions, long-context testing and how providers validate outputs, not just whether an endpoint returns a successful status code. Cloudflare acknowledged that its pre-launch long-context checks measured HTTP responses and engine performance without checking model output and coherence.
The audit contest points to a related but distinct challenge: AI can lower the cost of producing security reports, but assessing their validity still takes human effort. A high submission count is not the same as a high count of distinct vulnerabilities. Together, the developments show pressure on both sides of security work: preventing cross-session errors in deployed systems and sorting useful findings from growing report volumes.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
Two Pressures on AI Security
In a language model, a key-value cache, often called a KV cache, stores intermediate data from a prompt so the system does not have to process the entire input again for every generated token. Cloudflare says the cache pages in this setup were not cleared between requests; instead, the system relied on the next request overwriting them. The company described that as a common performance practice, making correct allocation and tracking especially important.
Cloudflare ran the model in a disaggregated setup: one GPU pool processed prompts and created the cache, while another generated responses. Its report says the over-limit prompt was treated as rejected and replaced with a one-token placeholder, but queues in both stages checked whether a request had finished rather than whether it had been rejected. That left the decode stage reading pages that had not been overwritten.
The report also says the underlying SGLang issue had been reported publicly as issue #30233 on July 6, 2026, though Cloudflare says it noticed that report during its investigation. In the separate contest example, Jump’s response is a new bounty-platform rule requiring researchers to spend 1 SOL per submission, about $100 according to CoinDesk. The source account also cites earlier changes by curl and Bugcrowd aimed at managing report volume.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare’s incident report
Customer Notices and Exposure Scope
Cloudflare’s report gives a count of 155 affected responses, but the available account does not specify how many customers received them, what exact information appeared in each response or whether any recipient recognized that material came from another request. It also does not say how affected customers were notified.
The company says it found no evidence of deliberate exploitation, but that is its assessment rather than proof that no one could have accessed or retained exposed text. The source does not provide details of a customer-by-customer review or independent verification of the findings. It is also unclear whether the SGLang issue has since been fixed upstream or whether other deployments using similar configurations were affected.
For the contest, Jump’s belief that AI agents found or wrote nearly all submissions is not a confirmed count of AI-generated reports. The source does not provide a breakdown of which reports were authored by people, generated by tools or verified as vulnerabilities.
Fixes, Notifications and Review Rules
Cloudflare says it restored a fixed version of GLM-5.3 on the evening the incident was declared, after taking the model offline. The report also describes the company’s investigation and remediation, but the source account provides no further public timetable for customer notifications or for additional details about the affected responses.
For users and providers, the key follow-up is whether long-context testing now checks the content and isolation of model outputs as well as system performance. The incident report’s account of the validation gap makes that an important area to watch, although the source does not list a full set of planned changes or independent audit results.
Jump’s platform will require a 1 SOL deposit for each report, according to the source account. How that rule affects submission quality, participation and the time needed to identify valid findings remains to be seen. The broader issue will continue as researchers, bounty programs and infrastructure providers adapt their review and testing practices to AI-assisted work.
Key Questions
What happened in Cloudflare’s AI incident?
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the problem to a memory-capacity mismatch combined with a bug in SGLang.
Which prompts could trigger the problem?
According to Cloudflare, the affected responses followed prompts longer than 681,280 tokens. The service advertised a larger 1,048,576-token context window than the relevant prefill memory pool could accommodate.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of requests as consistent with ordinary long-context use. That is the company’s assessment; the available report account does not establish what each customer received or knew.
What does the Jump Crypto audit contest show?
The Firedancer contest received 809 reports from 162 researchers, which Jump said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly all of them, and its new platform requires a 1 SOL deposit per submission. The source does not give a verified AI-authorship breakdown.
Source: ThorstenMeyerAI.com
