🔍 Read the full analysis: What A Stranger’s Session Reveals About Cloudflare’s AI Cache on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says its hosted GLM-5.3 model returned 155 responses containing information from other customers’ requests between August 27 and September 9, 2026. A configuration mismatch and a bug in the SGLang inference engine combined to expose stale GPU cache data; Cloudflare says it took the model offline and found no evidence of deliberate exploitation. The report does not explain how affected customers were notified.
Cloudflare says its hosted GLM-5.3 AI service returned 155 responses containing data from other customers’ requests during a 14-day period in August and September 2026. The company’s October 26 incident report attributes the exposure to a context-length configuration mismatch combined with a bug in the SGLang inference engine, and says it found no evidence that anyone deliberately exploited the flaw.
The issue affected requests to Cloudflare Workers AI’s @cf/zai-org/glm-5.3 endpoint. According to the report, only prompts longer than 681,280 tokens could trigger the problem. A security researcher, Gadi Evron of Knostic, reported that very long prompts sometimes returned text belonging to other users’ sessions through Cloudflare’s HackerOne program on September 8.
Cloudflare’s configuration advertised a context window of 1,048,576 tokens, while the memory pool available for the model’s key-value cache held 681,280. The cache stores intermediate information generated as a model processes a prompt. Cloudflare said it expected oversized requests to produce an error and had tested long-context performance, but had not checked the resulting outputs for correctness and coherence.
A separate SGLang bug allowed requests that could not fit in the cache to pass through parts of Cloudflare’s split prefill-and-decode system. The prefill stage wrote only a placeholder, while the decode stage could read cache pages that still contained material from earlier requests. Cloudflare says it received the report at 23:11 UTC on September 8, began verification the following morning and declared an incident at 13:22. It took the model offline 38 minutes after declaring the incident and restored a fixed version later that day, according to the source report.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident illustrates how isolation between customers can depend on inference-engine bookkeeping, not just on the model itself. Cloudflare said cache pages are not zeroed between requests because doing so can reduce performance; instead, the next request is expected to overwrite them. In this case, the mismatch between reserved and written cache pages meant some data could remain accessible to a later request.
For customers using hosted AI services, the issue matters because prompts can contain source code, internal documents or other sensitive material. The report says 155 responses were affected, but does not establish how many customers were involved or what kinds of information appeared in those responses. The count is a total reported by Cloudflare, not a rate or comparison with normal service activity.
The same week’s security-reporting development points to a different pressure created by AI. Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which the company reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission, according to the source report. Its new bounty platform requires researchers to stake 1 SOL per report, described there as about $100. The juxtaposition is relevant: AI can contribute to finding flaws, while also increasing the volume of reports people must assess. It does not establish that AI-generated submissions are necessarily invalid.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Ninja Luxe Café Premier 3-in-1 Espresso Machine, Drip Coffee & Cold Brew
Vitamix Propel Series 510 Professional-Grade Blender, 3 Programs, Black
As an affiliate, we earn on qualifying purchases.
A Configuration Gap and SGLang Bug
Cloudflare runs the model in a disaggregated setup: one group of GPUs processes prompts and builds the cache, then sends it to another group that generates responses. The system reserved cache capacity for the advertised context length, but the prefill pool had less capacity. When an oversized prompt was rejected and replaced with a one-token placeholder, the two queues checked whether processing had finished but not whether the request had been rejected. That allowed the decode side to proceed with pages that had not been overwritten.
Cloudflare’s report says the shared-cache behavior is a common performance practice. It also says the underlying SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but Cloudflare did not notice it until investigating the incident. The report says the affected responses’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw.
A separate example in the source material concerns the workload facing security programs. It says curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. These figures describe different programs and events; they do not by themselves quantify the share of reports that were AI-generated or the rate of valid findings.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its incident report
Customer Notice and Exposure Scope
Cloudflare’s report gives a total of 155 affected responses, but the supplied account does not say how many individual customers or requests were represented, or identify the content exposed in each response. It also does not explain how or when affected customers were notified. Cloudflare’s assessment that the traffic resembled ordinary use is based on its review; the report does not provide further detail about the evidence behind that conclusion.
The source material says the researcher’s report was made through HackerOne, but it does not include a full account of the final fix, independent verification of remediation or any subsequent customer statements. It also does not establish a direct connection between the cache incident and the separate rise in AI-assisted bounty submissions. The available information supports treating these as two security developments reported in the same week, not as one cause-and-effect story.
Follow-Up on Fixes and Notices
The immediate next questions are whether Cloudflare provides additional information about customer notification, the number of customers affected and the data observed, and whether independent testing confirms the fixed deployment prevents the failure path. Cloudflare says it restored a fixed version on the evening of September 8; the supplied report does not identify a further public milestone or a date for additional disclosures.
For security teams, the incident points to checks beyond successful HTTP responses and performance measurements: long-context outputs need to be examined for correctness and for unintended data from other requests. In parallel, Jump Crypto’s report-staking system will offer a test of whether requiring a deposit reduces low-value submissions without deterring useful findings. No results from that policy are included in the source material.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses from its hosted GLM-5.3 service contained data from other customers’ requests between August 27 and September 9, 2026. The company attributes the exposure to a cache-capacity mismatch and an SGLang bug.
Which prompts could trigger the issue?
According to Cloudflare’s report, the affected requests were longer than 681,280 tokens. The service had advertised a context window of 1,048,576 tokens, exceeding the capacity of the relevant prefill cache pool.
Did Cloudflare say the flaw was deliberately exploited?
No. Cloudflare said the timing and volume of affected requests were consistent with ordinary long-context use and that it found no evidence of deliberate exploitation. That is the company’s assessment of the incident.
What did Cloudflare do after the report?
Cloudflare investigated after a researcher filed a HackerOne report on September 8, took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening, according to the source account.
What remains unknown about the exposure?
The supplied report does not state how many customers were affected, what specific data appeared in the responses or how customers were notified. It also does not provide independent confirmation of the fix.
Source: ThorstenMeyerAI.com
