🔍 Read the full analysis: AI Spam, KV Caches, And The Search For Cloudflare Bugs on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. A separate Firedancer audit contest and broader bug-bounty figures point to a surge in AI-assisted reports, making it harder to distinguish useful findings from low-quality submissions.
Cloudflare disclosed that its hosted GLM-5.3 AI model returned 155 responses containing data from other customers’ requests over a two-week period in 2026, while a separate security-audit contest highlights a growing review burden from AI-written bug reports. The incidents show two distinct sides of AI security: a technical failure that exposed information across sessions, and a flood of machine-assisted reports that can make valid vulnerabilities harder to identify.
Cloudflare’s incident report, published October 26, says the affected requests were made between August 27 and September 9 through its Workers AI hosting of the Z.ai GLM-5.3 model. Cloudflare attributed the exposure to a mismatch between its configured context window of 1,048,576 tokens and a prefill GPU memory pool that could hold 681,280 tokens, combined with a bug in the open-source inference engine SGLang. Only prompts exceeding the smaller pool’s capacity could trigger the issue.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8, according to the report. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It found no evidence of deliberate exploitation and said the affected requests’ timing and volume were consistent with ordinary long-context use. The report does not specify how or when affected customers were notified.
A separate example comes from Jump Crypto’s $1 million Firedancer audit contest. The contest received 809 submissions from 162 researchers, which Jump assessed as 127 unique findings. Jump believes AI agents found or wrote nearly all of them, according to the source report. The company’s new bounty platform requires researchers to spend 1 SOL per submission; CoinDesk put that amount at about $100. The fee is intended to deter low-value submissions, though its effect is not yet established.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
AI Speeds Reports, Not Review
The Cloudflare incident illustrates how a failure in infrastructure around a model can expose information even when the model itself is not at fault. The leak arose from the interaction of memory-pool configuration and inference-engine handling of oversized prompts. Because the affected output could appear coherent and arrive with a successful HTTP response, customers might not have had an obvious sign that content from another session had entered a reply.
The audit figures point to a different operational risk. AI tools can help researchers generate or discover potential bugs, but each submission still needs human triage and verification. A larger volume of reports can consume time that security teams would otherwise spend validating serious findings and fixing vulnerabilities. The source material describes a wider pattern: curl ended its bounty program in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures indicate pressure on review processes, but they do not by themselves establish how many reports were AI-generated or valid.
Together, the cases show that AI-related security work involves more than model behavior. Providers must test the systems that serve models, while bounty programs need ways to handle high submission volumes without excluding researchers who submit legitimate findings.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Trezor Safe 7 Crypto Hardware Wallet
Ledger Flex + Folio Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
In Cloudflare’s account, the relevant KV cache stores intermediate values a model uses while processing a prompt and generating a response. The cache is held in GPU memory and allocated in pages to separate requests. Cloudflare says those pages are not zeroed between requests; the inference system is expected to overwrite them before another request can read them. That approach is used for performance, but it makes correct allocation and tracking important to keeping sessions isolated.
Cloudflare described its GLM-5.3 deployment as a disaggregated system: one group of GPUs reads a prompt and builds the cache, while another generates the response. When an oversized prompt exceeded the prefill pool, SGLang marked it as rejected and substituted a one-token placeholder. Cloudflare says queues in both stages checked whether a request had finished, but not whether it had been rejected. The decode stage then read pages reserved for the full prompt, some of which still contained other users’ prompts or partial generations.
The company said it had known the configured context window exceeded the prefill pool’s capacity, but expected the inference engine to return an error. It also acknowledged that its pre-launch long-context tests checked HTTP status and performance without validating the generated text’s coherence. The source says a related SGLang issue, numbered 30233, had been reported on July 6, 2026; Cloudflare says it discovered that report during its investigation.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notice and Report Quality
Cloudflare’s report does not say which customers were affected, what data appeared in the 155 responses, or how and when those customers were notified. The company said it found no evidence of deliberate exploitation, but the report does not provide a complete account of the content exposed or explain whether all affected responses were viewed by recipients.
It is also unclear how many of the Firedancer contest’s 127 unique findings were valid vulnerabilities, how Jump determined that AI agents were responsible for nearly all submissions, or whether the new 1 SOL submission fee will improve report quality. The broader submission figures cited in the source do not identify the share written or assisted by AI. These distinctions matter: raw report counts are not equivalent to confirmed bugs.
Fixes and Triage Measures
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it responded to the incident. The company’s published account does not provide a further remediation schedule or detail customer notifications. Readers and customers may look for additional information on what data was involved, the steps taken to validate the fix, and whether similar configurations affect other hosted models.
For security-audit organizers, Jump’s per-report charge is a test of whether a financial cost can reduce low-quality submissions while leaving access open to researchers with meaningful findings. The source material does not give results from the platform’s operation yet. The broader challenge for bounty programs will be to measure report quality and review time—not just submission volume—as AI tools become more common in vulnerability research.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a configuration mismatch and a bug in SGLang.
What caused the data to appear in other customers’ responses?
Cloudflare says prompts longer than 681,280 tokens could exceed the available prefill cache pool. A rejected request then passed through the split inference system, which read cache pages that still held content from earlier requests.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and assessed the affected requests as consistent with ordinary long-context use. That is the company’s finding, not an independent determination cited in the source material.
Why is Jump Crypto charging researchers to submit reports?
Jump’s new platform requires 1 SOL per report, which CoinDesk valued at about $100. The source describes the fee as a response to a high volume of AI-assisted submissions, but does not yet show whether the charge improves report quality.
How many Firedancer contest submissions were unique findings?
The contest received 809 reports from 162 researchers. Jump said those submissions amounted to 127 unique findings; the source does not state how many were confirmed vulnerabilities.
Source: ThorstenMeyerAI.com
