🔍 Read the full analysis: Why Cloudflare’s AI Bug Story Involves Both Privacy And Spam on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 model to return data from other customers’ requests in 155 responses between August 27 and September 9, 2026. Separately, a Jump Crypto audit contest produced 809 submissions but only 127 unique findings, illustrating the growing burden of reviewing AI-generated security reports.
Cloudflare disclosed that its hosted GLM-5.3 AI model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026, according to an incident report published October 26. The incident involved a configuration mismatch and a bug in the open-source SGLang inference engine; in a separate development, a Jump Crypto audit contest showed how AI-generated security reports can create a review bottleneck even as automated tools make bug hunting easier.
Cloudflare said the leak could be triggered only by prompts longer than 681,280 tokens. Its Workers AI service advertised a context window of 1,048,576 tokens, but the memory pool used to store the model’s intermediate processing data had capacity for fewer tokens. A separate SGLang bug allowed requests that exceeded that capacity to pass through parts of Cloudflare’s split prefill-and-decoding system instead of failing cleanly. The decoding process could then read memory pages that still held material from other requests.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8, according to the incident account. Cloudflare said it declared an incident the following day, took the model offline 38 minutes after that declaration, and restored a fixed version that evening. It reported no evidence of deliberate exploitation. The company said the affected requests, after excluding its own tests and the researcher’s, appeared consistent in timing and volume with ordinary long-context use rather than repeated attempts to exploit the flaw.
The second case comes from Jump Crypto’s $1 million Firedancer audit contest, which received 809 reports from 162 researchers and yielded 127 unique findings, according to the supplied source. Jump believes AI agents found or wrote nearly all the submissions. Its new bounty platform requires researchers to spend 1 SOL per report, described by CoinDesk as about $100. The two cases are distinct: the Cloudflare incident involved a service flaw and customer data, while the contest concerns the workload of assessing security reports.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Data Isolation Meets Report Overload
The Cloudflare incident matters because one customer’s request should not expose another customer’s data. The reported cause was not that the GLM-5.3 model intentionally reproduced private information. Rather, the service’s memory management and request handling failed together under a specific long-prompt condition. That distinction helps explain the technical cause, but it does not lessen the privacy concern for customers whose content may have appeared in another user’s response.
The contest points to a different pressure on security teams: generating reports is becoming cheaper than validating them. A large submission count can include duplicates, low-value findings, or reports that still need careful reproduction and triage. The gap between 809 submissions and 127 unique findings illustrates why raw report volume is not the same as confirmed vulnerabilities. Taken together, the stories show two sides of AI security work: systems can introduce or amplify risks, while AI-assisted reporting can strain the human processes used to identify and fix them.
For organizations using hosted AI, the episode raises practical questions about isolation, testing at extreme context lengths, and the handling of incident disclosures. For security researchers and bounty operators, the contest highlights the cost of reviewing submissions at scale. These are related pressures, but the source material does not establish that AI-generated reports caused the Cloudflare bug or contributed to its discovery.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
As an affiliate, we earn on qualifying purchases.
How the Two Incidents Differ
Cloudflare attributed the leak to two faults working together. Its prefill GPUs created a model’s key-value cache, a record of intermediate calculations used to generate text, and passed that data to separate decoding GPUs. Cloudflare said cache pages were not cleared between requests, a practice it described as common and useful for performance because the next request is expected to overwrite them. In this case, the configuration allowed a request to reserve more pages than the prefill stage actually filled.
Cloudflare said it had known about the mismatch before launch and expected oversized prompts to produce an error. It also acknowledged that its long-context tests checked HTTP response codes and engine performance without checking the model’s output and coherence. In SGLang, the oversized prompt was marked rejected and replaced with a one-token placeholder, but queues in the split setup checked whether a request was finished rather than whether it had been rejected. The decoding stage could consequently read unfilled pages. Cloudflare said it noticed during its investigation that a related SGLang issue had been reported on July 6, 2026.
The broader reporting pressure was already visible in other programs, according to the source. Curl ended its bug bounty program in January 2026, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions that month. Those figures describe different programs and periods; they do not, by themselves, establish a single industry-wide rate of growth. They do show why some bounty operators are trying to limit low-quality or repetitive submissions.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare, in its incident report
Customer Impact and Disclosure Gaps
Cloudflare’s report gives the total of 155 affected responses, but the supplied material does not say how many customers were affected, what kinds of information appeared in those responses, or how each affected customer was notified. It also does not provide an independent verification of the company’s assessment that the requests were consistent with ordinary use. Cloudflare said it found no evidence of deliberate exploitation, which does not establish that no one attempted to trigger the flaw.
The report also leaves open how the SGLang issue was handled upstream and whether additional systems could be affected by the same bug. The contest figures do not identify how many submissions were generated wholly or partly by AI, nor how Jump determined that AI agents were responsible for nearly all of them. The source describes that as Jump’s belief, not a verified breakdown.
Fixes and Review Policies Ahead
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of September 9 after taking the model offline. The supplied report does not specify further public milestones, customer notification details, or whether Cloudflare plans to publish additional findings. Customers will be looking for information about the scope of exposure and what safeguards or testing changes followed.
On the bounty side, Jump’s platform is applying a 1 SOL charge per report as a way to discourage excessive submissions, according to the source. Whether that approach improves the proportion of useful reports or creates barriers for researchers is not yet established. Security teams and bounty programs will continue to face the task of distinguishing actionable findings from duplicates and low-quality submissions as AI-assisted reporting becomes more common.
Key Questions
What happened in the Cloudflare incident?
Cloudflare said its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch combined with an SGLang bug affecting very long prompts.
Was the GLM-5.3 model itself responsible?
Cloudflare attributed the incident to its service configuration and a bug in the SGLang inference engine, not to intentional behavior by the model. The issue involved memory pages that could retain data from earlier requests and be read when an oversized prompt was mishandled.
Did Cloudflare find evidence of an attack?
Cloudflare said it found no evidence of deliberate exploitation. It said the requests, after excluding internal tests and the researcher’s activity, appeared consistent with ordinary long-context use. That is the company’s assessment; the report does not establish that no exploitation was attempted.
Why is Jump Crypto charging for bug reports?
Jump’s new bounty platform requires researchers to spend 1 SOL per report, described in the source as about $100. The change follows a contest that drew 809 submissions but produced 127 unique findings, amid concern that AI tools can increase report volume and the work needed to review it.
Source: ThorstenMeyerAI.com
