🔍 Read the full analysis: Bug Hunters Face AI Spam As Cloudflare’s KV Cache Leak Draws Attention on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. Separately, Jump Crypto says AI agents likely generated or found nearly all reports in a 809-submission Firedancer audit contest, intensifying debate about how security programs can handle AI-generated submissions.
Cloudflare disclosed October 26 that its hosted GLM-5.3 AI model returned 155 responses containing text from other customers’ requests over a 14-day period, after a memory-management failure allowed stale GPU data to reach new responses. The disclosure coincides with a separate pressure point for security teams: Jump Crypto says AI agents likely generated or found nearly all reports submitted to a major audit contest, underscoring how AI can contribute both to security failures and to a surge in low-value bug reports.
Cloudflare’s report says the leak affected requests sent to the @cf/zai-org/glm-5.3 endpoint from August 27 through September 9. The issue could be triggered only by prompts longer than 681,280 tokens. Cloudflare said it found 155 affected responses, excluding its own tests and the researcher’s reports. It characterized the remaining requests’ timing and volume as consistent with ordinary long-context use, rather than repeated attempts to exploit the bug.
The incident involved two faults, according to Cloudflare: its prefill GPUs had a memory pool sized for fewer tokens than the model’s advertised 1,048,576-token context window, and the open-source inference engine SGLang mishandled requests that exceeded available capacity in Cloudflare’s split prefill-and-decode setup. The rejected request could pass through queues that checked whether processing was complete but not whether it had been rejected. The decoding stage then read cache pages that had not been overwritten, exposing fragments of other users’ prompts or generated text.
Security researcher Gadi Evron of Knostic reported the issue through HackerOne on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. It reported no evidence of deliberate exploitation. The company’s report does not say how or when affected customers were notified.
The separate bug-reporting example comes from Jump Crypto’s $1 million Firedancer audit contest, which received 809 submissions from 162 researchers. The submissions amounted to 127 unique findings, according to the source report. Jump believes AI agents found or wrote nearly every report. Its new bounty platform requires researchers to stake 1 SOL, valued at about $100 in the report’s account, for each submission.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI Security
The Cloudflare incident shows that a failure in the infrastructure around an AI model can expose data even when the model itself is not the source of the defect. Cross-customer data exposure is a direct concern for organizations sending lengthy or sensitive prompts to hosted services. Cloudflare’s account narrows the affected condition to unusually long prompts, but the report confirms that some responses contained material from other customers’ requests.
The audit contest points to a different operational cost. AI tools can help researchers identify vulnerabilities, but a rapid increase in submissions can also raise the time and expense required to verify each one. Jump’s 127 unique findings from 809 reports illustrate that submission totals do not equal distinct vulnerabilities. A deposit may discourage low-effort reports, but it could also affect who is willing to participate; the source material does not establish how the policy will work in practice.
Together, the cases show why security teams face pressure on both sides: AI systems must protect data across requests, while vulnerability programs need workable ways to assess reports that may be generated at scale. Neither development alone establishes that AI is broadly unsafe or that AI-assisted reports lack value. They do show that existing controls and review processes are being tested.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How Cache Handling Failed
A language model stores intermediate calculations for prompt tokens in a key-value, or KV, cache, usually held in GPU memory. In Cloudflare’s setup, cache memory was divided into pages and reused across requests. Cloudflare says pages were not cleared between users because the next request was expected to overwrite them, a performance practice it described as common. That arrangement depends on correct request accounting to prevent one request from reading another’s data.
Cloudflare’s prefill system was configured with capacity for 681,280 tokens, despite the larger advertised context limit. The company said it expected oversized requests to produce an error and had tested long-context requests by checking HTTP status codes and engine performance, but not the model’s output and coherence. In SGLang, an oversized prompt was reduced to a one-token placeholder after rejection. In the split configuration, the decode side still reserved space for the original prompt and read pages that prefill had not rewritten.
Cloudflare says the underlying SGLang problem had been reported as issue #30233 on July 6, 2026, but it did not identify the issue until its own investigation. The source also describes a broader rise in AI-related reporting: curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures are separate examples and do not, by themselves, establish a common cause or a comparable rate of valid findings.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
Customer Impact Still Unspecified
Cloudflare has reported the number of affected responses and the token-length condition, but its report as provided does not identify the number of customers involved, the specific information exposed, or how customers were informed. It is also unclear whether any exposed text was retained or used outside the responses in which it appeared. Cloudflare said it found no evidence of deliberate exploitation, but that does not establish that every affected request or downstream use has been identified publicly.
The account does not provide independent verification of the incident findings or details about the full scope of the fix. It also leaves open how the service will prevent similar cache errors across other models or configurations. On the reporting side, Jump’s assessment that AI agents generated or found nearly all contest reports is attributed to the company; the source material does not provide a method for independently classifying each submission or evidence on how the 1 SOL stake will affect valid participation.
Fixes and Reporting Rules
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it took the service offline. The next relevant information would be any further account of customer notification, the scope of affected data, and safeguards added to test oversized prompts and cache handling. The source material does not give a date for a follow-up report or describe additional remediation steps beyond the fix and temporary shutdown.
For vulnerability programs, Jump’s deposit-based submission policy will be one approach to watch as organizations adjust to AI-generated reports. Its impact will depend on whether it reduces low-quality submissions without discouraging researchers with valid findings. Further information on submission quality, review workloads and participation under the new rules has not been provided.
Key Questions
What happened in the Cloudflare incident?
Cloudflare said its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The issue involved very long prompts and a combination of Cloudflare configuration and SGLang inference-engine faults.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and assessed the timing and volume of the affected requests as consistent with ordinary long-context use. That is the company’s finding as described in its incident report.
How did the cache error expose other users’ text?
Cloudflare says the decode stage read KV-cache pages that a rejected oversized request had not overwritten. Because the cache pages were reused and not cleared between requests, some still contained other users’ prompts or partial generations.
Why is Jump Crypto requiring a 1 SOL stake?
Jump’s new bounty platform requires researchers to stake 1 SOL per report amid a contest in which 809 submissions produced 127 unique findings. The stated context is the burden of reviewing AI-generated or AI-assisted reports; the available account does not establish how the policy will affect valid submissions.
Were affected Cloudflare customers notified?
The source material does not say how or when Cloudflare notified affected customers. It also does not specify the number of customers involved or detail the information contained in the exposed text.
Source: ThorstenMeyerAI.com
