🔍 Read the full analysis: Cloudflare’s KV Cache Leak: A Privacy Scare Amid AI Spam on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says a configuration mismatch and an inference-engine bug caused 155 responses from its hosted GLM-5.3 model to include text from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company took the model offline after a researcher’s report and restored a fixed version the same evening. Separately, a $1 million security audit contest drew hundreds of reports that organizers say were largely AI-generated or AI-assisted, highlighting pressure on vulnerability review processes.
Cloudflare said 155 responses from its hosted GLM-5.3 model contained text from other customers’ requests during a 14-day period in August and September, according to an incident report published Oct. 26. The company attributed the exposure to a configuration mismatch in its Workers AI service combined with a bug in the open-source SGLang inference engine; it said it found no evidence of deliberate exploitation.
The incident affected requests to Cloudflare’s @cf/zai-org/glm-5.3 endpoint between Aug. 27 and Sept. 9, 2026. Cloudflare’s report says every affected request had a prompt longer than 681,280 tokens. A security researcher, Gadi Evron of Knostic, reported the behavior through Cloudflare’s HackerOne program on Sept. 8, saying very long prompts sometimes returned text from other users’ sessions.
Cloudflare said it declared an incident at 13:22 UTC on Sept. 9 and took the model offline 38 minutes later. It restored a fixed version that evening. The report says the 155 responses included the company’s and researcher’s test activity in the initial count; after excluding those, Cloudflare said the remaining requests’ timing and volume appeared consistent with ordinary long-context use rather than repeated attempts to exploit the bug.
Cloudflare described two contributing failures. Its service advertised a 1,048,576-token context window, while the memory pool used for the model’s key-value cache could hold only 681,280 tokens. The SGLang bug then allowed an oversized request that had been rejected during prompt processing to pass through a separate processing queue. In the split setup, the response stage could read cache pages that had not been overwritten for that request, exposing remnants of other prompts and partial outputs.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a defect in the infrastructure serving a model can expose information even when the model itself is not the source of the failure. Cloudflare said the GLM-5.3 model was not at fault; the problem arose from the interaction between its service configuration and the inference engine’s handling of requests that exceeded available cache capacity.
For customers, the reported impact was not merely an incorrect or incoherent answer: some responses contained fragments from other users’ requests. Those fragments could include sensitive material if it had been included in a prompt. Cloudflare’s report does not establish what kinds of customer data appeared in the 155 responses, or whether any particular customer suffered further harm.
The case also illustrates why testing only whether a request returns successfully can miss privacy failures. Cloudflare said its long-context checks measured HTTP response codes and engine performance but did not validate the model’s output and coherence. In this incident, the response could return HTTP 200 and appear coherent, while arriving faster than expected was the only reported clue that something was wrong.
Products Worth Considering
Anker SOLIX C200 DC Portable Power Station, 192Wh, 200W
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
Logitech MX Keys S Wireless Keyboard, Graphite
As an affiliate, we earn on qualifying purchases.
A Separate Strain on Bug Bounties
The Cloudflare disclosure appeared alongside a separate example of how AI tools are affecting security review. Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which the company said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly every submission, according to the supplied account. That is the organizers’ assessment, not an independently established count of AI-generated reports.
The contest points to a different operational problem: security teams can receive more reports without gaining an equivalent increase in verified vulnerabilities. The source says Jump’s new bounty platform requires researchers to spend 1 SOL, about $100 according to CoinDesk, for each report. It also cites curl ending its bounty in January, Bugcrowd beginning to prohibit “submission farming” in March, and HackerOne recording 46,947 submissions in March 2026. Those figures describe separate programs and periods; they do not by themselves establish a common rate of growth or a single cause.
The two developments are related through the workload of security teams, not through a proven direct connection. Cloudflare’s incident involved a technical flaw that allowed cross-request data to appear in responses. The audit-contest figures concern the volume and review cost of vulnerability submissions. Together, they show why organizations need both effective infrastructure testing and processes that distinguish actionable security findings from low-value reports.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare, in its incident report
Customer Notifications and Data Scope
Cloudflare’s report gives the number and period of affected responses, but the supplied material does not say how affected customers were notified or identify the customer data types involved. It also does not explain whether the 155 responses contained complete prompts, partial text, or a range of content in each case. The company’s statement that it found no evidence of deliberate exploitation does not establish that no one saw or retained exposed text.
The source material also does not specify the full technical validation behind the fix, whether Cloudflare has audited all related models and deployments for the same failure mode, or whether SGLang has issued a separate account of the bug. Cloudflare said it discovered during its investigation that a related issue had been reported to SGLang as issue #30233 on July 6, 2026. The extent to which that report matched the production failure is not detailed here.
Follow-Up on Fixes and Disclosure
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of Sept. 9, after taking the model offline during its response. The incident report is the latest public account in the supplied material; it does not set out a further remediation deadline or describe additional customer-facing steps. Readers should look for any subsequent Cloudflare or SGLang statements addressing customer notification, the scope of exposed content, and safeguards against similar cache-handling failures.
For the wider security community, the next question is how programs will manage increased report volume while preserving review quality. Jump’s move to charge a deposit per submission is one approach described in the source, but the material does not report its results. The Cloudflare case also underscores the need to test returned content—not just successful status codes and performance—when validating services that process very long prompts.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare said 155 responses from its hosted GLM-5.3 model contained text from other customers’ requests between Aug. 27 and Sept. 9, 2026. It attributed the issue to a cache-capacity configuration mismatch and a bug in SGLang.
Which requests could trigger the problem?
According to Cloudflare’s report, affected requests had prompts longer than 681,280 tokens, the capacity of the relevant key-value cache pool. Cloudflare advertised a larger context window of 1,048,576 tokens.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation. After excluding its own tests and the researcher’s activity, it said the remaining requests appeared consistent in timing and volume with ordinary use.
How did Cloudflare respond?
Cloudflare declared an incident on Sept. 9, took the model offline 38 minutes later, and restored a fixed version that evening, according to its report.
What is the connection to AI-generated security reports?
There is no reported direct connection to the Cloudflare incident. Separately, Jump Crypto said its Firedancer audit contest received 809 reports that reduced to 127 unique findings, and it believes AI agents found or wrote nearly all of them. The example highlights the review burden created by high submission volumes.
Source: ThorstenMeyerAI.com
