🔍 Read the full analysis: AI Answer Privacy Meets The Challenge Of Bug Hunting At Cloudflare on ThorstenMeyerAI.com
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. A separate Jump Crypto audit contest drew 809 submissions that the company says largely reflected AI agents’ involvement, prompting a paid reporting rule. Together, the cases show how AI can create security risks while also increasing the work of assessing vulnerability reports.
The Cloudflare incident affected requests to the @cf/zai-org/glm-5.3 endpoint between August 27 and September 9, the company said. A researcher, Gadi Evron of Knostic, reported the issue through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes returned text belonging to other users’ sessions. Cloudflare counted 155 affected responses, all associated with prompts exceeding 681,280 tokens.
Cloudflare attributed the exposure to two faults that interacted: its configuration advertised a 1,048,576-token context window while the relevant memory pool could hold 681,280 tokens, and an error-handling bug in the open-source inference engine SGLang allowed rejected requests to continue through a split processing setup. The company said memory pages left over from earlier requests could then be read by a later request when the system failed to overwrite them as expected.
Cloudflare’s report says the company took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It said it found no evidence of deliberate exploitation. Separately, Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which Jump assessed as 127 unique findings. The firm believes AI agents found or wrote nearly all the reports; that is Jump’s assessment, not an independently verified count.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users‘ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers‘ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Security Risks Meet Review Overload
The Cloudflare disclosure shows how a failure in infrastructure and inference software can expose one customer’s prompt material in another customer’s response. The company says the affected requests required prompts longer than 681,280 tokens, a narrow condition, but the incident highlights the importance of checking generated output and isolation behavior—not just whether a service returns a successful response.
Jump’s contest points to a different operational problem: AI tools can lower the effort needed to produce vulnerability submissions, while the work of reproducing, validating and prioritizing them remains with security teams. Jump’s decision to require a 1 SOL stake per report, valued at about $100 in the source account’s CoinDesk attribution, is an attempt to discourage low-value submissions. The two developments are separate; there is no indication that the audit-report surge caused or contributed to Cloudflare’s leak.
Popular right now
KitchenAid Classic Series 4.5 Quart Tilt-Head Stand Mixer K45SS, Onyx Black
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
iRobot Roomba Max 715 Pet Robot Vacuum with AutoEmpty Dock
As an affiliate, we earn on qualifying purchases.
How the Two Cases Emerged
Cloudflare operates the hosted model using separate GPU pools for prompt processing and response generation. Its report says the prompt-processing pool had less memory available for the key-value cache than the advertised context limit implied. The company expected oversized requests to fail, but its pre-launch long-context tests checked HTTP status and engine performance without checking the model’s output and coherence.
In the SGLang issue described by Cloudflare, an oversized request was marked rejected and reduced to a one-token placeholder. In the split setup, queues checked whether a request had finished but not whether it had been rejected. The response-generation side had reserved cache pages for the full prompt, and, according to Cloudflare, read pages that had not been overwritten. Cloudflare also said the underlying SGLang issue had been reported in issue 30233 on July 6, 2026, but it noticed that report only during its investigation.
The Jump contest is part of a wider debate about AI-assisted vulnerability reporting. The source account says curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures describe separate programs and periods; they do not establish that all submissions were AI-generated.
„“we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.”“
— Cloudflare incident report
Customer Notice and Scope Questions
Cloudflare’s report, as summarized in the source material, does not say how affected customers were notified or provide details on individual responses. The company’s count of 155 covers affected responses, but the available account does not specify how many customers or distinct sessions were involved, what kinds of information appeared, or whether any recipients retained or acted on the exposed text.
Cloudflare said it found no evidence of deliberate exploitation, which does not establish that the data was never seen or copied by another user. The source material also does not provide an independent audit of the incident findings. For Jump’s contest, the claim that AI agents found or wrote nearly every submission is the company’s assessment; no method for measuring AI involvement is given here.
Follow-Up on Fixes and Reporting
Cloudflare says it restored a fixed model version after taking the service offline on September 9. The source material does not state whether the company has published further information about customer notification, the number of affected customers, or additional safeguards for long-context requests. Those details would clarify the practical scope of the exposure and how the service’s testing has changed.
Jump’s new bounty platform requires researchers to commit 1 SOL for each report, according to the source account. The policy’s effect on report volume and quality remains to be seen. More broadly, security teams and AI providers will need to show how they validate model outputs, isolate customer data and sort useful vulnerability findings from submissions that cannot be reproduced.
Key Questions
What happened in Cloudflare’s AI incident?
Cloudflare said its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch combined with an SGLang error-handling bug.
Who could trigger the leak?
According to Cloudflare, the issue affected prompts longer than 681,280 tokens. The report says the requests were consistent in timing and volume with ordinary long-context use, and Cloudflare found no evidence of deliberate exploitation.
How did Cloudflare respond?
Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening, the company’s report says.
What was unusual about Jump Crypto’s audit contest?
The Firedancer contest received 809 reports from 162 researchers, which Jump said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly all the submissions, and its new platform requires a 1 SOL stake per report.
What remains unknown about the Cloudflare exposure?
The source account does not say how Cloudflare notified affected customers, how many customers or sessions were involved, or what types of information appeared in the responses. It also does not include an independent review of the company’s findings.
Source: ThorstenMeyerAI.com
