🔍 Read the full analysis: What Links Cloudflare’s KV Cache Leak To AI Spam? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare said a configuration mismatch and an SGLang bug caused 155 GLM-5.3 responses to include text from other customers’ requests between August 27 and September 9, 2026. A separate Firedancer audit contest received 809 reports that Jump Crypto says were largely found or written by AI agents, highlighting the strain on security review as well as the risks of AI systems.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests during a 14-day period in August and September 2026. The company attributed the incident to a mismatch in its context-window configuration combined with a bug in the open-source SGLang inference engine; a separate security-audit contest reported this week shows how AI-generated submissions are also adding to the workload of people who investigate software vulnerabilities.
Cloudflare’s incident report, published October 26, said the affected endpoint was @cf/zai-org/glm-5.3 on Workers AI. The leak could be triggered only by prompts longer than 681,280 tokens. Cloudflare counted 155 affected responses from August 27 through September 9, after excluding its own tests and the researcher’s requests. It said the remaining traffic appeared consistent in timing and volume with ordinary long-context use, rather than repeated deliberate exploitation.
The company traced the issue to two faults. Its configuration advertised a 1,048,576-token context window, while the prefill GPU memory pool used for the model’s key-value cache held only 681,280 tokens. An SGLang bug then allowed requests rejected for exceeding available capacity to continue through Cloudflare’s split prefill-and-decode system. The decode stage could read cache pages that had not been overwritten and still contained data from earlier requests.
Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. The report says the model itself was not at fault: the failure involved Cloudflare’s deployment and the inference engine’s handling of rejected requests.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on Security Teams
The Cloudflare disclosure illustrates a privacy risk in shared AI infrastructure: when requests use GPU memory in common, correct isolation depends on the system’s bookkeeping and handling of errors. Here, Cloudflare said cache pages were not cleared between requests because the next request was expected to overwrite them. The SGLang failure meant that expectation was not met for some rejected prompts, allowing earlier text to appear in later model responses.
The incident also points to a testing gap. Cloudflare said it had known about the context-window and memory-pool mismatch before launch and expected oversized prompts to return an error. It had tested response codes and engine performance at long context lengths, but said it had not checked the model’s output and coherence in those tests. The case highlights why infrastructure checks need to test not only whether a request succeeds, but also whether the returned content belongs to that request.
At the same time, AI tools are making it easier to produce bug reports at scale, but not necessarily easier to decide which reports are valid. Jump Crypto’s Firedancer audit contest received 809 submissions from 162 researchers, which the company said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly all of them. The two stories are not reported as causally connected; together, they show AI affecting both the systems that need security and the human process for checking them.
Products Worth Considering
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
As an affiliate, we earn on qualifying purchases.
How Cache Pages Crossed Requests
A language model stores intermediate calculations about a prompt in a key-value (KV) cache so it can generate later tokens without processing the entire input again. For long prompts, that cache can occupy substantial GPU memory. Cloudflare said its inference setup divided work between one GPU pool that processed prompts and built the cache and another that generated responses. Cache pages were returned to a shared pool after a request; they were not zeroed before reuse.
According to Cloudflare’s account, an oversized prompt was marked rejected and replaced with a one-token placeholder by SGLang. In the split setup, queues checked whether a request had finished, but not whether it had been rejected. The decode stage had reserved pages for the longer prompt, while prefill wrote only the placeholder. As a result, some pages still contained earlier users’ prompts or partial generations. Cloudflare said the client received an HTTP 200 response and a reply that could appear coherent; a faster-than-expected response was the only visible clue it identified.
The source report also says the underlying SGLang issue had been filed on July 6, 2026, as issue #30233. Cloudflare said it became aware of that report during its own investigation. Separately, the Firedancer submissions fit a broader pattern cited in the source: curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those examples concern different programs and do not establish that every submission was AI-generated.
““we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.””
— Cloudflare incident report
Customer Notice and Exposure Scope
Cloudflare’s report does not specify how affected customers were notified, whether all customers whose text appeared in the responses have been identified, or what kinds of information were present in each response. The stated count is 155 affected responses, not a count of distinct customers or a measure of how much data was exposed. The report does not establish that every response contained sensitive information.
Cloudflare said it found no evidence of deliberate exploitation, but that is the company’s assessment of the traffic it reviewed, not proof that no one attempted to trigger the bug. The source material also does not provide an independent audit of the incident findings or additional detail on the corrected deployment’s validation. Jump Crypto’s conclusion that AI agents found or wrote nearly every Firedancer submission is likewise the company’s assessment; the supplied account does not detail how it classified each report.
Follow-Up on Fixes and Reports
Cloudflare says it restored a fixed version of GLM-5.3 on the same evening the incident was declared. The incident report establishes that the company disabled the model during its response, but the source material does not give a later independent verification or describe a fuller customer-notification process. Further public details about affected accounts, the scope of exposed text, or changes to long-context testing would clarify the incident’s impact and the safeguards now in place.
On the audit side, Jump Crypto’s platform now requires researchers to spend 1 SOL, reported as about $100 by CoinDesk, for each submission. The fee is intended to limit low-quality or automated report volume, but its effect on valid submissions is not yet established in the source material. The broader question for security programs is how to filter AI-assisted reports without discouraging researchers who use AI to identify genuine flaws.
Key Questions
What was the Cloudflare KV cache leak?
Cloudflare said 155 responses from its hosted GLM-5.3 endpoint included text from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a configuration mismatch and an SGLang bug.
Who could trigger the leak?
Cloudflare said the issue affected prompts longer than 681,280 tokens. Its report says the requests remaining after internal and researcher tests were consistent with ordinary long-context use, and that it found no evidence of repeated deliberate exploitation.
Was the GLM-5.3 model itself responsible?
No. The account attributes the failure to Cloudflare’s deployment configuration and a bug in SGLang, the open-source inference engine used in the system.
How is the Firedancer audit contest related?
It is a separate story, not a reported cause or consequence of the Cloudflare incident. Jump Crypto said its contest received 809 reports, representing 127 unique findings, and believes AI agents found or wrote nearly all of them. The comparison is that AI is affecting both security risks and the volume of work required to review security reports.
What remains unknown about the Cloudflare incident?
The report does not say how affected customers were notified, how many distinct customers were involved, or what information appeared in each response. It also does not provide an independent assessment of Cloudflare’s findings.
Source: ThorstenMeyerAI.com
