🔍 Read the full analysis: How To Understand Cloudflare’s AI Session Leak And Spam Problem on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned data from other customers’ requests in 155 responses between August 27 and September 9, 2026. Separately, Jump Crypto says an audit contest produced 809 submissions but only 127 unique findings, illustrating how AI-assisted reporting can burden security reviewers. The two developments point to separate risks: AI service isolation failures and a growing volume of reports that may be repetitive or low-value.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a 14-day period, while a separate Jump Crypto audit contest showed how AI-generated security reports can overwhelm review processes. The Cloudflare incident involved a configuration mismatch and a bug in the SGLang inference engine; the company says it found no evidence of deliberate exploitation.
Cloudflare’s report says the affected responses came from requests to its Workers AI endpoint for @cf/zai-org/glm-5.3 between August 27 and September 9. The issue could be triggered only by prompts exceeding 681,280 tokens. Security researcher Gadi Evron reported that long prompts sometimes produced text belonging to other users’ sessions through Cloudflare’s HackerOne program on September 8.
Cloudflare traced the problem to two faults. Its prefill GPU pool had capacity for 681,280 tokens, although the service advertised a 1,048,576-token context window. Separately, SGLang mishandled rejected oversized requests in Cloudflare’s split prefill-and-decode setup: one stage treated a failed request as a one-token placeholder, while the next stage proceeded as if the full prompt had been processed. Some GPU cache pages consequently retained other users’ prompt text or partial outputs.
Cloudflare says it declared an incident, took the model offline 38 minutes later, and restored a fixed version that evening. The company reported that, after excluding its own tests and the researcher’s requests, the affected traffic appeared consistent with ordinary long-context use rather than repeated attempts to exploit the bug. The source report also describes a separate Jump Crypto Firedancer audit contest: 809 submissions from 162 researchers yielded 127 unique findings, and Jump believes AI agents found or wrote nearly all of them.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on AI Security
The Cloudflare incident raises a direct customer data-isolation concern: a response generated for one request should not include material retained from another customer’s session. Even though the company says the trigger required an unusually long prompt and found no evidence of deliberate exploitation, the disclosed 155 responses show that a software and configuration failure can expose cross-request data without an attacker repeatedly probing the service.
The audit contest points to a different operational problem. AI tools can lower the effort needed to produce bug reports, but reviewers still have to check whether each submission is distinct, reproducible and in scope. Jump’s figures—809 reports versus 127 unique findings—show the gap between submission volume and validated findings in that contest. For security teams, faster report production does not automatically mean faster vulnerability fixes; time spent filtering duplicates can compete with investigation of genuine flaws.
The developments are not evidence of a direct connection between Cloudflare’s leak and the audit-report surge. Together, however, they illustrate two challenges accompanying wider AI deployment: reliable isolation in hosted model infrastructure and the capacity to triage security work generated with AI assistance.
Products Worth Considering
Samsung 42-Inch S90H OLED 4K Smart TV Bundle
Blueair Blue Pure 211i Max Air Purifier
Shark Navigator Robot Vacuum with 30-Day Self-Empty Base, White (AV2110S)
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
Language models use a key-value (KV) cache to store intermediate calculations from a prompt, avoiding the need to recompute them as the model generates text. The cache occupies GPU memory and is divided into pages that requests can borrow and return. Cloudflare’s report says those pages were not cleared between requests; the system relied on later requests overwriting them. That practice can support performance, but it makes correct allocation and request handling important to keeping data separate.
In Cloudflare’s setup, one GPU pool read prompts and built the cache, while another generated responses. The mismatch between the advertised context size and available cache capacity meant some requests could not be handled as expected. The SGLang bug then allowed a rejected request to move through queues that checked whether processing had finished but did not check whether the request had been rejected. The decode stage read pages that the prefill stage had not overwritten.
The source report says the SGLang issue had been filed as issue #30233 on July 6, 2026, and Cloudflare discovered it during its investigation. Cloudflare also acknowledged that its pre-launch long-context checks focused on HTTP status and engine performance, rather than validating the generated output and its coherence.
“We only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.”
— Cloudflare, in its incident report
Questions the Report Leaves Open
Cloudflare’s report, as summarized in the source material, does not explain how affected customers were notified, whether the 155 responses contained sensitive information in every case, or how many customers were affected. It also does not establish whether any recipient noticed or retained another customer’s text. The company’s statement that it found no evidence of deliberate exploitation is not the same as proof that no one could have encountered or used the issue.
The account does not provide a full technical breakdown of every affected response or describe any independent review of Cloudflare’s investigation. It says the company restored a fixed model version, but further details about the fix and any changes to testing or monitoring are not included in the supplied material.
Jump Crypto’s assessment that AI agents found or wrote nearly every contest submission is also its own characterization. The reported totals establish that 809 submissions were grouped into 127 unique findings; they do not, by themselves, show how many reports were false, unusable or generated fully by AI. The contest figures should not be treated as a universal measure of AI-generated security reports.
Fixes and Review Rules Ahead
Cloudflare says it restored the fixed model the evening of the incident. The next questions are whether the company will publish additional detail on customer notification, the affected data and the safeguards added after the incident. The source material does not give a date for any further disclosure or describe a planned outside audit.
On the security-reporting side, Jump Crypto has introduced a bounty platform that requires researchers to spend 1 SOL per report, about $100 according to CoinDesk, as a way to discourage low-quality or repetitive submissions. The source also notes that curl ended its bounty program in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. How well the new fee limits noise without discouraging valid reports remains to be seen.
For readers using hosted AI services, the immediate practical takeaway is to follow provider incident updates and avoid treating a successful response or HTTP status as proof that an AI request was handled correctly. For service operators and security programs, the developments put attention on output validation, isolation checks and review systems that can distinguish a useful finding from a high-volume submission.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare said its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The issue affected very long prompts and involved a configuration mismatch and an SGLang inference-engine bug.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said the requests it reviewed appeared consistent in timing and volume with ordinary long-context use, and that it found no evidence of repeated deliberate exploitation. That statement describes the company’s findings; it does not establish that no user could have encountered the bug.
What is the connection between the leak and the audit-report flood?
The source presents them as separate developments, not as one incident. The Cloudflare report concerns cross-customer data exposure in a hosted model service. The Jump Crypto contest concerns the time required to assess a large volume of AI-assisted security submissions.
What did Jump Crypto’s contest numbers show?
The contest received 809 reports from 162 researchers, which were consolidated into 127 unique findings. Jump believes AI agents found or wrote nearly all of the submissions, but the figures do not establish that every report was low quality or entirely AI-generated.
Source: ThorstenMeyerAI.com
