🔍 Read the full analysis: AI Spam Meets Cloudflare’s Cache Leak In A Bug Hunter’s Inbox on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 model to return 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. Separately, Jump Crypto says AI agents likely generated or found nearly all reports in a 809-submission Firedancer audit contest, prompting a deposit requirement on its new bounty platform. The incidents show different pressures created by AI: risks in deployed services and growing costs of reviewing security reports.
Cloudflare said October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a two-week period, while a separate Jump Crypto audit contest showed how AI-generated submissions are straining bug-review programs. The Cloudflare incident involved prompts exceeding 681,280 tokens and a combination of a company configuration mismatch and a bug in the open-source SGLang inference engine.
According to Cloudflare’s incident report, the affected responses were produced between August 27 and September 9, 2026, by the GLM-5.3 endpoint on Workers AI. Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes returned text from other users’ sessions. Cloudflare said it found no evidence of deliberate exploitation; after excluding its tests and the researcher’s requests, it said the activity’s timing and volume were consistent with ordinary long-context use.
The failure required two conditions. Cloudflare configured the service to advertise a 1,048,576-token context window, but its prefill GPU memory pool could hold only 681,280 tokens. A bug in SGLang then allowed requests that exceeded the pool’s capacity to pass through a split prefill-and-decode system as if they had not been rejected. The decode stage could read cache pages that prefill had not overwritten, exposing content left by other requests.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The company’s report says the service returned HTTP 200 for affected responses. It also says the mismatch was known before launch, but long-context testing checked response codes and performance without validating the generated output’s coherence.
A separate case cited in the source material concerns Jump Crypto’s $1 million Firedancer audit contest. It drew 809 submissions from 162 researchers, which Jump reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission. Its new bounty platform requires researchers to stake 1 SOL per report, described by CoinDesk as about $100, a measure intended to deter low-quality submissions.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI Security
The Cloudflare disclosure concerns customer data isolation, a basic requirement for any hosted service that processes private prompts. The reported leak was tied to a narrow technical condition—prompts longer than 681,280 tokens—but the affected material could include text from other customers’ requests. The report does not establish that anyone deliberately sought or used that data.
The audit contest points to a different operational problem: more reports do not necessarily mean more verified bugs. Jump’s 809 submissions yielded 127 unique findings, leaving reviewers to distinguish useful reports from duplication or low-quality work. If AI lowers the cost of producing submissions faster than programs can assess them, researchers and security teams may spend more time triaging reports and less time validating serious vulnerabilities.
Together, the cases underline that AI changes both sides of security work. Model services need careful isolation and output-level testing, while bounty operators need ways to preserve access for useful researchers without allowing automated volume to overwhelm review.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Two Incidents Differ
The Cloudflare issue involved the KV cache, the intermediate data a language model stores while processing a prompt and generating a response. In the setup described by Cloudflare, cache pages were reused rather than cleared between requests, with the next request expected to overwrite them. That approach can support performance, but it depends on correct allocation and bookkeeping. In this incident, the capacity mismatch and SGLang rejection-handling bug allowed the decode process to read pages that had not been replaced.
Cloudflare’s report says another user had filed SGLang issue #30233 on July 6, 2026; Cloudflare said it noticed that report during its investigation. The company also acknowledged that its own long-context testing did not check output content and coherence, a gap relevant to testing systems where a successful HTTP response may still contain incorrect or unsafe material.
The bug-report surge is part of a broader debate over automated security submissions. The source material notes that curl ended its bug bounty program in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. These figures are separate examples, not a shared measure of the same program or a direct comparison of verified vulnerabilities.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its incident report
Customer Notifications and Scope
Cloudflare’s published report identifies 155 affected responses, but the supplied material does not say how many customers received them, what specific information was exposed, or how affected customers were notified. It is also unclear whether any customer saw or retained another user’s content beyond the responses counted in the investigation. Cloudflare said it found no evidence of deliberate exploitation, which does not establish that exploitation was impossible.
The report describes the conditions and response, but the supplied account does not provide an independent audit of Cloudflare’s findings or a full description of the remedial changes. For Jump Crypto, the share of reports attributable to AI is an estimate by the company; the available information does not detail how that assessment was made or how the 1 SOL stake will affect participation and report quality.
Fixes and Bounty Review
Cloudflare says it restored a fixed version of the model on the evening it responded to the incident. The next questions for customers and security reviewers are whether the company will provide further information about notifications and impact, and whether its testing and configuration controls have changed to catch similar failures before deployment.
Jump Crypto’s new platform will apply its 1 SOL submission stake to bounty reports, but the source material does not specify how disputes, rejected submissions, or refunds will be handled. Its results will offer an early indication of whether a financial barrier reduces report volume while keeping useful findings accessible to researchers. The two cases remain separate developments: Cloudflare’s disclosure concerns a specific service incident, while Jump’s contest highlights a wider challenge for security programs reviewing AI-assisted work.
Key Questions
What happened to Cloudflare’s GLM-5.3 service?
Cloudflare says the hosted model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The incident required prompts longer than 681,280 tokens and a configuration mismatch combined with an SGLang bug.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and assessed the remaining requests as consistent with ordinary long-context use. That is the company’s finding, not proof that deliberate access was impossible.
How did the cache bug expose other users’ text?
Cloudflare said the prefill system could not hold the full advertised prompt length. A bug in how SGLang handled rejected requests let the decode system read cache pages that had not been overwritten, which could contain other users’ prompts or partial generations.
Why is Jump Crypto requiring a deposit for reports?
Jump says its Firedancer contest received 809 submissions that amounted to 127 unique findings, and believes AI agents found or wrote nearly all of them. The new platform requires a 1 SOL stake per report, which is intended to discourage low-quality submissions; its effect on participation remains unknown.
Source: ThorstenMeyerAI.com
