🔍 Read the full analysis: Cloudflare’s AI Cache Leak And The Bug Hunters Facing A Spam Flood on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. Separately, Jump Crypto says AI agents likely found or wrote nearly all reports in a large Firedancer audit contest, prompting a new fee for submissions. The incidents show distinct security pressures: preventing data exposure and reviewing a growing volume of low-value reports.
Cloudflare’s hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests during a two-week period, the company said in an incident report published October 26. In a separate development underscoring pressure on security teams, Jump Crypto says AI agents likely found or wrote nearly all reports submitted to its $1 million Firedancer audit contest, leading it to charge researchers a small amount for each new report.
Cloudflare said the leak affected requests made between August 27 and September 9 to its GLM-5.3 endpoint on Workers AI. All affected requests used prompts longer than 681,280 tokens. The company attributed the incident to two issues working together: a mismatch between its configured context window and available memory, and a bug in the open-source inference engine SGLang.
Cloudflare’s configuration advertised a context window of 1,048,576 tokens, but the relevant memory pool could hold 681,280. Requests that exceeded the pool should have been rejected. Instead, in Cloudflare’s split prefill-and-decode setup, the rejected requests could pass through queues that checked whether processing was finished but not whether it had been rejected. The decode stage then read memory pages that had not been written for that request and still contained other users’ prompts or partial generations.
A researcher reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The company reported 155 affected responses after excluding its own tests and the researcher’s activity. It said it found no evidence of deliberate exploitation and described the affected traffic as consistent with ordinary long-context use.
The separate contest involved 809 submissions from 162 researchers, which Jump Crypto reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all of the reports. Its new bounty platform requires researchers to spend 1 SOL per report; CoinDesk put the value at about $100. That figure can change with the token’s price.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI-Assisted Security
The Cloudflare incident shows how a boundary failure in shared computing infrastructure can expose one customer’s data to another, even when the model itself is not the source of the defect. The company’s account points to configuration and inference-engine behavior, as well as testing that checked response codes and performance without validating generated output and coherence at very long context lengths.
For customers, the exposure is consequential because text sent to a hosted model may contain code, business material or other sensitive information. Cloudflare’s report gives a count and a time window, but it does not identify the affected customers or explain what kinds of text appeared in the responses. The company also says there is no evidence of deliberate exploitation; that is not the same as proof that no one could have encountered the leak.
The contest points to a different operational problem. AI tools can make it easier to produce reports, but triage still requires human review: teams need to determine whether a report is distinct, reproducible and security-relevant. A submission fee may discourage volume, but it also changes the cost of participating and does not by itself establish the quality of findings. Together, the stories show that AI can amplify both the scale of security work and the consequences of weak controls.
Popular right now
Dyson Ball Animal Total Clean Upright Vacuum
LG C2 Series 65-Inch OLED evo 4K Smart TV (OLED65C2PUA, 2022)
Ninja CREAMi 7-in-1 Ice Cream Maker, NC301
As an affiliate, we earn on qualifying purchases.
How the Cache and Report Flood Connect
A language model’s key-value (KV) cache stores intermediate data from a prompt so the system can generate later words without processing the entire prompt again. Cloudflare said its inference engine allocates cache memory in pages and does not clear each page between requests, relying on the next request to overwrite it. The company described this as a common performance practice. In this incident, the systems failed to keep a rejected request from reading pages that still held earlier users’ data.
Cloudflare said the SGLang issue had been filed as issue #30233 on July 6, 2026, but it became aware of it during its investigation. The incident report says Cloudflare had known about the mismatch between the context window and memory pool before launch, expected oversized requests to return an error, and had seen successful responses in long-context tests. The company acknowledged that those tests checked HTTP status and engine performance, not the model’s output and coherence.
The contest figures fit a wider pattern described in the source report. Curl ended its bug bounty program in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. The source provides that number as a monthly total, not as a measured increase against a stated baseline. These examples concern different programs and policies; they do not establish that every new report is AI-generated or low quality.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its incident report
Customer Notices and Exposure Details
Cloudflare’s report, as summarized in the source material, does not say how affected customers were notified, identify them, or detail the sensitive information present in the 155 responses. It also does not establish whether any customer acted on leaked text or whether data was retained outside the responses. Cloudflare said it found no evidence of deliberate exploitation, but the report’s account does not resolve every possible exposure or use.
The exact amount of data visible in each response is not specified here, nor is the full scope of the remediation beyond taking the model offline and restoring a fixed version. The source material also provides no independent technical review of Cloudflare’s findings.
For the Firedancer contest, Jump’s view that AI agents were responsible for nearly all submissions is an attribution by the company, not a reported independent measurement. The source does not explain how Jump classified AI involvement, what the 127 unique findings contained, or how the new fee will affect legitimate researchers and participation.
Remediation and Bounty Rules Ahead
Cloudflare says it restored a fixed version of the model the evening it was taken offline. Its incident report provides the public account of the failure and response, but the available source material does not identify a further public review date or describe a planned customer notification process. Readers should look for additional company updates on the affected accounts, the scope of any exposure and changes to validation for long-context requests.
On the contest side, Jump Crypto’s 1 SOL-per-report requirement is now the stated platform response to the submission volume. The next useful indicators will be whether the charge reduces duplicate or low-quality reports, how many researchers continue to participate, and whether the program publishes more detail on the findings. No results from the new policy are included in the source material.
Key Questions
What information did Cloudflare say was exposed?
Cloudflare said 155 responses contained text from other customers’ requests. The source material does not specify the content of each response or identify affected customers.
What caused the GLM-5.3 leak?
Cloudflare attributed it to a memory-pool and context-window mismatch combined with a bug in SGLang. Oversized prompts could be treated as rejected but still pass through parts of the split inference system, which then read cache pages containing other users’ data.
Did Cloudflare find evidence of an attacker exploiting the issue?
Cloudflare said it found no evidence of deliberate exploitation and that the affected requests appeared consistent with ordinary long-context use. That is the company’s finding, not a claim that every possible exposure has been ruled out.
Why is Jump Crypto charging for bug reports?
Jump says its $1 million Firedancer contest received 809 reports that reduced to 127 unique findings, and that AI agents likely found or wrote nearly all submissions. Its platform now requires 1 SOL per report, which the source estimates at about $100 at the time.
Were affected Cloudflare customers notified?
The incident details provided here do not say how Cloudflare notified affected customers. The company’s report, as summarized in the source, does not identify the affected customers or describe a notification process.
Source: ThorstenMeyerAI.com
