🔍 Read the full analysis: A Stranger’s Session, An AI Answer, And A Cloudflare KV Leak on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company traced the issue to a context-window configuration mismatch combined with a bug in SGLang, and says it took the model offline and restored a fix. A separate audit contest described in the source material highlights how AI-generated vulnerability reports can add to the workload of security reviewers.
Cloudflare said October 26 that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, after a configuration mismatch and an inference-engine bug allowed stale GPU memory to be read. The company says it took the model offline after verifying the problem, restored a fixed version that evening, and found no evidence of deliberate exploitation.
Cloudflare’s report says every affected response followed a prompt longer than 681,280 tokens. The service advertised a context window of 1,048,576 tokens, but the memory pool used to hold the model’s intermediate calculations could store less. The resulting mismatch alone was not supposed to expose data: Cloudflare expected the inference engine to reject prompts that exceeded the available capacity.
The second fault was in SGLang, the open-source inference engine used in the system. According to Cloudflare, an oversized prompt was marked as rejected and replaced with a one-token placeholder. In the company’s split prefill-and-decode setup, queues checked whether a request had finished but did not check whether it had been rejected. The decode stage could then read reserved memory pages that prefill had not overwritten, exposing material from other requests.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare’s timeline says verification began the next morning and an incident was declared at 13:22 UTC. It says the affected model was taken offline 38 minutes after that declaration, and a fixed version was restored later that day. The company counted 155 affected responses across the incident period, excluding its own tests and the researcher’s requests.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in the infrastructure around an AI model can expose customer data even when the model itself is not the source of the flaw. In this case, the reported cause was the interaction between memory capacity settings and request-handling logic in a distributed inference system. The model’s output could contain text that belonged to a different customer’s session.
Cloudflare says the memory pages are not cleared between requests because the next request is expected to overwrite them, a practice it describes as common and useful for performance. That approach makes correct allocation and request-state checks central to isolation. For customers using hosted models with very long context windows, the incident is a reminder that service configuration and inference software matter alongside model behavior and access controls.
The source material also describes a separate pressure point in vulnerability reporting. Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which the company said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly all the reports. Its new platform requires a 1 SOL deposit per submission, described in the source as about $100, in an effort to limit low-value volume. These are distinct developments, but together they show two sides of AI security: tools can help generate findings, while organizations still need to verify reports and prevent software failures.
Popular right now
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How the Two Faults Combined
A language model uses a KV cache to store intermediate calculations from a prompt so it does not have to process the entire prompt again for each generated token. Cloudflare’s report says the cache was held in GPU memory divided into fixed-size pages. In the service’s setup, one group of GPUs processed prompts and prepared the cache, while another group used it to generate answers.
Cloudflare says its system reserved pages based on the full prompt, but an oversized request was reduced to a one-token placeholder during prefill. The decode stage nevertheless read the pages reserved for the original prompt. Since the pages were not cleared between requests, some contained other users’ prompts or partial generations. The response could still return HTTP 200 and appear coherent; Cloudflare says the unusually fast response was the only apparent signal described in the report.
The SGLang issue involved had been reported publicly as issue #30233 on July 6, 2026, according to Cloudflare, which says it noticed the report during its investigation. The separate audit-contest example reflects a broader reporting challenge cited in the source: curl dropped its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures are reported in the source material; they do not establish that all submissions were AI-generated.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
Customer Notice and Exposure Scope
Cloudflare’s report gives a total of 155 affected responses, but the supplied material does not say how many customers or accounts were involved, what specific kinds of information appeared, or whether any recipients recognized and retained the exposed text. It also does not explain how affected customers were notified. Cloudflare says it found no evidence of deliberate exploitation, but that is the company’s assessment rather than proof that no one saw or used the exposed content.
The source material does not provide an independent technical review of Cloudflare’s investigation or the final scope of the disclosure. It also does not give details about any subsequent SGLang fix, or say whether the underlying issue was resolved upstream. In the audit-contest example, Jump’s belief that AI agents found or wrote nearly every report is attributed to the company; the source does not provide a method for independently measuring AI involvement.
Follow-Up on Fixes and Notifications
The immediate response described by Cloudflare is complete: the model was taken offline after the incident was declared and a fixed version was restored the same evening. The next information readers would need is whether Cloudflare has notified all affected customers, how it determined the number of responses and accounts involved, and whether it has changed long-context validation or memory-isolation checks across other hosted models.
Further details from Cloudflare or SGLang could clarify how the rejection-state bug will be addressed beyond this deployment and whether additional testing has been completed. For the audit contest, the source says Jump’s platform now requires a 1 SOL deposit per report; it does not provide later figures showing whether that policy reduced duplicate or AI-generated submissions. No further timetable or milestone is specified in the material.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. It attributes the leak to a context-capacity mismatch and an SGLang request-handling bug.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of affected requests as consistent with ordinary long-context use. That assessment does not establish that no customer data was seen by another user.
What information was exposed?
The report, as summarized in the source material, says responses contained text from other users’ prompts and partial generations. It does not specify the full range of data involved or identify how many distinct customers were affected.
Why did the system return the other request’s text?
The service’s advertised context window exceeded the available KV-cache memory. A bug allowed an oversized, rejected request to pass through part of a split inference system, where the decode stage read memory pages that had not been overwritten and still held data from other requests.
What does the Firedancer contest have to do with the leak?
It is a separate security development included in the same source material, not part of the Cloudflare incident. Jump Crypto said its audit contest received 809 reports that reduced to 127 unique findings and believes AI agents found or wrote nearly all of them, illustrating the workload of reviewing vulnerability submissions.
Source: ThorstenMeyerAI.com
![The GNU Emacs Architecture: Unlocking The Core [Pdf]](https://nanomachines.net/wp-content/uploads/2026/07/the-gnu-emacs-architecture-unlocking-the-core-pdf-featured-560x300.jpg)
