🔍 Read the full analysis: How Bug Hunters Navigate AI Spam After Cloudflare’s Cache Leak on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 model to return 155 responses containing other customers’ request data between August 27 and September 9, 2026. At the same time, a Jump Crypto audit contest drew 809 reports but produced 127 unique findings, illustrating the review burden of AI-assisted submissions. The incidents are separate; together they show how AI systems can create both security risks and more work for the people who assess them.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a 14-day period in August and September. The incident, caused by a configuration mismatch combined with a bug in the open-source SGLang inference engine, comes amid a separate pressure on security teams: AI-assisted reports are increasing the amount of material bug programs must review.
Cloudflare’s incident report says the affected service was its GLM-5.3 endpoint on Workers AI. The leak could be triggered only by prompts longer than 681,280 tokens. Cloudflare attributed the failure to its prefill memory pool being smaller than the advertised context window, alongside an SGLang bug in how rejected requests were handled in its split prefill-and-decode setup.
In Cloudflare’s account, the rejected request was replaced with a one-token placeholder during prefill, while the decode side proceeded as if the full prompt had been processed. As a result, it read cache pages that had not been overwritten and could contain other users’ prompts or partial generations. The affected responses appeared successful to clients, with an HTTP 200 status. Cloudflare said it counted 155 affected responses after excluding its own tests and the researcher’s activity.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. It reported no evidence of deliberate exploitation. The report does not specify how or when affected customers were notified.
A separate example of the review challenge comes from Jump Crypto’s $1 million Firedancer audit contest. It received 809 submissions from 162 researchers, which Jump said narrowed to 127 unique findings. Jump believes AI agents found or wrote nearly all the submissions. Its new bounty platform requires researchers to spend 1 SOL per report, about $100 according to CoinDesk, a measure intended to discourage low-value submissions.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why Cache Isolation and Triage Matter
The Cloudflare incident shows that shared GPU memory and cache management can create cross-customer exposure when request handling fails at more than one point. Cloudflare says the model itself was not at fault; the reported cause was the interaction between its capacity configuration and the inference engine’s handling of rejected requests. For customers using hosted models with very long prompts, the incident underscores that a successful response code does not by itself prove that the output came only from that customer’s input.
The Jump contest points to a different operational problem. AI tools can make it easier to generate or discover candidate bugs, but reviewing reports still takes human and program resources. A high submission count is not the same as a high count of distinct vulnerabilities: in this contest, 809 reports became 127 unique findings. Submission fees may reduce noise, but can also affect who participates; the available source does not establish how Jump’s new policy will change report quality or access.
Together, the episodes matter because AI is affecting both sides of security work: systems that handle sensitive data need reliable isolation, while the teams testing those systems need ways to sort useful findings from large volumes of submissions. The incidents are not described as causally connected.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
Brother TD-2020A 2‑Inch Direct Thermal Desktop Label Printer with USB
As an affiliate, we earn on qualifying purchases.
How the Two Incidents Differ
Cloudflare’s service used a key-value (KV) cache to store intermediate calculations from a prompt so the model would not need to recompute them for each generated token. Its report says cache pages were not zeroed between requests; the system relied on the next request overwriting them. Cloudflare described this as common practice for performance, making accurate allocation and request-state checks important safeguards.
The underlying capacity mismatch involved a configured context window of 1,048,576 tokens and a prefill KV pool sized for 681,280. Cloudflare said it expected oversized prompts to be rejected and had seen successful responses in long-context tests. It also acknowledged that those tests checked HTTP status and engine performance, but not output content and coherence. The report says the SGLang issue had been filed publicly as issue #30233 on July 6, 2026, but Cloudflare noticed it only during its investigation.
The pressure from AI-generated vulnerability submissions predates the Cloudflare disclosure. The source reports that curl ended its bounty program in January 2026, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. These are separate examples of programs responding to volume; they do not establish that every submission was AI-generated or low quality.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
What the Reports Do Not Resolve
Cloudflare’s public account gives a total of 155 affected responses, but the supplied material does not identify the affected customers, explain what kinds of information appeared in the responses, or say how customers were notified. Cloudflare said it found no evidence of deliberate exploitation, but that is not the same as a statement that every possible use of the bug has been ruled out.
The source also does not provide a full account of the fix, independent verification of the incident findings, or details on whether other services using the same SGLang behavior were affected. For the audit contest, Jump’s assessment that AI agents were involved in nearly every report is attributed to the company; the available material does not describe its method for making that estimate or the severity of the 127 unique findings.
Follow-Up on Fixes and Reporting
Cloudflare says it restored a fixed model version on the evening it declared the incident. The company’s published report provides the current account, but further information about customer notification, the scope of exposed content and any independent review would help clarify the impact. The supplied material does not give a date for additional disclosures.
For bug bounty programs, the next test will be whether measures such as Jump’s report fee reduce duplicate or low-value submissions without deterring researchers with valid findings. More data on submission quality, triage time and researcher participation would show how effective those policies are. Until then, the confirmed record is two distinct developments: a specific Cloudflare cache leak that the company says it fixed, and an ongoing challenge for security programs facing large volumes of AI-assisted reports.
Key Questions
What happened in Cloudflare’s AI service?
Cloudflare says its hosted GLM-5.3 model returned 155 responses that contained data from other customers’ requests between August 27 and September 9, 2026. It attributed the incident to a configuration mismatch and an SGLang request-handling bug.
Who could trigger the cache leak?
According to Cloudflare, the issue affected prompts longer than 681,280 tokens. The company said it found no evidence of deliberate exploitation and described the affected requests as consistent with ordinary long-context use.
Did Cloudflare take the model offline?
Yes. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. The supplied report does not detail how affected customers were notified.
How do AI-generated bug reports relate to the leak?
They are separate developments, not a reported cause of the Cloudflare incident. The Jump Crypto contest illustrates a broader triage issue: 809 submissions were reduced to 127 unique findings, while Jump believed AI agents found or wrote nearly all of them.
Source: ThorstenMeyerAI.com
