🔍 Read the full analysis: A Closer Look At Cloudflare’s AI Answer And Stranger Session Bug on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says a configuration mismatch and an SGLang inference-engine bug caused its hosted GLM-5.3 model to return 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. Separately, Jump Crypto says AI agents likely generated or found nearly all reports in a 2026 Firedancer audit contest, illustrating the growing burden of validating security submissions.
Cloudflare said October 26 that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests over a 14-day period, after a configuration mismatch combined with a bug in the open-source SGLang inference engine. The disclosure coincides with a separate AI-security challenge: Jump Crypto says AI agents likely found or produced nearly all reports submitted to a Firedancer audit contest, adding pressure on teams that must sort valid findings from low-value submissions.
Cloudflare’s report says the affected endpoint was @cf/zai-org/glm-5.3 on Workers AI. A researcher reported the issue through the company’s HackerOne program on September 8. Cloudflare found that only prompts exceeding 681,280 tokens could trigger the leak. It says it took the model offline 38 minutes after declaring an incident, then restored a fixed version later that day. Cloudflare reported no evidence of deliberate exploitation.
The company attributed the incident to two faults working together. Its prefill GPU pool had capacity for 681,280 tokens, although the advertised context window was 1,048,576 tokens. Separately, SGLang mishandled requests that exceeded available memory in Cloudflare’s split prefill-and-decode setup. The decode stage could read cache pages that prefill had not overwritten, exposing material left from other requests. Cloudflare said its long-context testing checked response codes and performance, but did not verify output content and coherence.
A second case described in the source report concerns Jump Crypto’s $1 million Firedancer audit contest. It received 809 submissions from 162 researchers; those submissions were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission. The company’s new bounty platform requires a 1 SOL stake per report, described in the source as about $100, to discourage low-quality submissions. These figures and Jump’s assessment are separate from Cloudflare’s incident and do not establish that AI-generated reports are necessarily invalid.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI Security
The Cloudflare disclosure shows how a failure in infrastructure around a model can expose data even when the model itself is not identified as the cause. Shared GPU memory and request isolation are operational security concerns: an implementation error can allow one customer’s material to appear in another customer’s response. For businesses using hosted models with long prompts, the incident makes provider configuration, testing and incident communication relevant parts of data protection.
The audit contest points to a different strain on security work. AI tools can lower the effort needed to generate or identify possible bugs, but reviewing submissions still takes human time. When a contest receives hundreds of reports that consolidate into far fewer unique findings, triage becomes a bottleneck. Jump’s deposit requirement is one response, though the source material does not establish whether it will improve report quality or deter legitimate researchers.
Together, the cases show that AI security has more than one operational challenge: systems using AI must protect customer data, while organizations defending software must distinguish useful findings from a growing volume of submissions. The evidence here is specific to these incidents and programs; it does not by itself quantify an industry-wide trend.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
When an inference engine processes a prompt, it stores intermediate values in a key-value (KV) cache so it can generate later tokens without repeating all earlier work. Cloudflare said its cache pages are not zeroed between requests; instead, the next request assigned a page is expected to overwrite it. That practice can support performance, but it depends on correct accounting of which pages belong to each request.
Cloudflare’s report describes a split architecture: a prefill pool reads the prompt and builds its cache, while a decode pool uses that cache to generate a response. A prompt too large for the prefill pool was marked rejected and replaced with a one-token placeholder. In Cloudflare’s account, the queues in the two stages checked whether a request was finished, but not whether it had been rejected. Decode had reserved pages for the full prompt, while prefill wrote only the placeholder. The remaining pages still contained data from other requests, which decode then read.
Cloudflare said the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but that it noticed the report only while investigating its own incident. The source also places the disclosure against other signs of pressure on vulnerability programs: curl ended its bounty in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those are separate developments and do not show that all submissions were AI-generated.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its incident report
Customer Notification and Report Quality
Cloudflare’s published account, as summarized in the source material, does not say how affected customers were notified, whether every exposed fragment was identified, or how much data was present in each response. The company says it found no evidence of deliberate exploitation, but that statement does not establish that every response was reviewed by an independent party. The report also does not provide enough detail here to assess the full scope of any customer impact.
It is also unclear how Cloudflare’s fix was validated after restoration, or whether the company changed its testing process beyond the steps described in the report. For the Jump Crypto contest, the available information does not break down how many of the 127 unique findings were valid, how many were attributable to AI tools, or how the 1 SOL deposit will affect participation. Jump’s estimate should be treated as its assessment, not as a verified count of AI-authored submissions.
Follow-Up on Fixes and Bounties
Cloudflare has said it restored a fixed version of the model on the evening of September 9 after taking the service offline. The next useful developments would be further detail from the company on customer notification, validation of the repair and any changes to long-context testing. The source material does not identify a scheduled follow-up report or a new deadline.
For Jump Crypto, the new platform’s deposit requirement will provide a test of whether a financial stake reduces low-value submissions without shutting out legitimate researchers. Any assessment will depend on future data about report volume, validity and researcher participation. More broadly, both cases leave organizations weighing performance and access against the cost of careful testing and review.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare said 155 responses from its hosted GLM-5.3 model contained text from other customers’ requests between August 27 and September 9, 2026. It attributed the incident to a configuration mismatch and an SGLang bug affecting prompts longer than 681,280 tokens.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and that the timing and volume of requests were consistent with ordinary long-context use. That is the company’s finding, not an independent confirmation.
What does the Jump Crypto contest have to do with the leak?
The contest is a separate development about AI’s effect on security work. Jump Crypto received 809 submissions that consolidated into 127 unique findings and believes AI agents found or wrote nearly all of them. It illustrates a report-review challenge, not a cause of Cloudflare’s incident.
How is Jump Crypto trying to reduce low-quality reports?
Jump’s new bounty platform requires researchers to stake 1 SOL per report, described in the source material as about $100. Whether that reduces low-quality submissions while preserving access for legitimate researchers remains unclear.
Source: ThorstenMeyerAI.com
