🔍 Read the full analysis: Cloudflare, AI Privacy, And The Spam Drowning Bug Hunters on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. A separate bug-bounty case shows the review burden from AI-generated submissions: Jump Crypto says 809 reports yielded 127 unique findings, and now charges a 1 SOL deposit per report.
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a 14-day period, after a configuration mismatch and an inference-engine bug allowed stale GPU memory to be read. The disclosure, published October 26, comes as a separate security-audit contest illustrates a growing review problem: AI-assisted submissions can multiply reports faster than bug hunters can validate them.
Cloudflare’s incident report says the affected endpoint was @cf/zai-org/glm-5.3, a hosted text-generation model built by Z.ai. The company traced the leak to requests longer than 681,280 tokens. It counted 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. Cloudflare said the requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw, and reported no evidence of deliberate exploitation.
The failure involved two issues. Cloudflare had advertised a 1,048,576-token context window, while the memory pool used to store prompt data could hold 681,280 tokens. A bug in the open-source inference engine SGLang then let requests that exceeded capacity pass through part of a split processing setup. The decode stage could read memory pages that the prefill stage had not overwritten, exposing text left by earlier requests.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8, according to the report. Cloudflare says it declared an incident at 13:22 UTC the next day and took the model offline 38 minutes later. A fixed version was restored that evening. The report says the SGLang bug had previously been filed as issue #30233 on July 6; Cloudflare says it became aware of that issue during its own investigation.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on AI Security
The Cloudflare disclosure shows that data isolation depends on the full serving system, not just on a model’s behavior. A configuration setting and an inference-engine error combined to expose fragments of other customers’ prompts. Cloudflare said the model itself was not at fault, but customers using long-context requests had no reason to expect another user’s text could appear in a response.
The separate bug-bounty example points to a different operational strain. Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which the company said reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every report. Its new bounty platform requires a 1 SOL deposit per submission, valued at about $100 by CoinDesk, a measure intended to discourage low-value report volume. The two cases are not reported as connected; together, they show how AI systems can create both security risks and new demands on the people responsible for assessing them.
For customers, the immediate concern is whether their data was included in affected responses and how they were notified. For security teams, the contest highlights the cost of reviewing duplicates, weak reports, and machine-generated submissions alongside genuine vulnerabilities. Finding candidate bugs may be getting cheaper; validating them and responding safely still takes time and expertise.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
As an affiliate, we earn on qualifying purchases.
How the Leak and Report Surge Fit
Cloudflare’s report describes a key-value cache, or KV cache, used to store intermediate calculations while a language model processes a prompt. The cache occupies GPU memory and is divided into pages allocated to requests. Cloudflare says those pages are not zeroed between requests; the next request is expected to overwrite them. In the affected setup, a prompt that exceeded the available pool was reduced to a one-token placeholder by SGLang, but the separate queues checked whether the request had finished rather than whether it had been rejected. The decode stage then read pages that still contained earlier users’ text.
Cloudflare said it had tested long-context performance and HTTP response codes before launch but had not checked model output and coherence at those lengths. The incident report describes that testing gap as part of the failure. Separately, the source account places the Firedancer contest amid broader changes to vulnerability-reporting programs: curl dropped its bounty in January 2026, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March. Those figures are reported by the source material; they do not by themselves establish how many reports were AI-generated.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare’s incident report
Customer Notice and Exposure Scope
Cloudflare’s report gives a count of 155 affected responses, but the supplied account does not identify the customers involved, describe what kinds of information appeared, or say how the affected customers were notified. It is also unclear whether each response contained a small fragment or a larger amount of another request’s text. The report’s statement that traffic appeared consistent with ordinary use is Cloudflare’s assessment, not proof that no one tried to exploit the issue.
The account also does not provide a complete technical description of the fix or say whether Cloudflare has changed testing across other hosted models and configurations. For the bounty contest, Jump’s view that AI agents found or wrote nearly all submissions is a company assessment; the available information does not specify how that conclusion was reached or how many reports were independently confirmed as AI-generated.
Fixes, Notifications and Review Rules
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of September 9 after taking the service offline. The next information readers need is whether affected customers have been contacted, what data appeared in the responses, and what safeguards or validation checks the company has added. The incident report’s publication makes the event public, but the supplied material does not confirm a customer-notification process or a broader audit of similar deployments.
Jump Crypto’s new platform will apply the 1 SOL per-report deposit described in the source account. Its effect on submission volume, report quality, and participation has not yet been established. More broadly, security programs will have to decide how to handle AI-assisted reports without discarding useful findings: the available examples show a dispute over review costs, but not a settled industry-wide approach.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses returned text from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a mismatch between the advertised context window and available memory, combined with a bug in SGLang.
Was the leak caused by the GLM-5.3 model itself?
Cloudflare said the model itself was not at fault. Its report describes a serving-system failure involving memory capacity and request handling in the inference engine.
Did Cloudflare find evidence of an attacker exploiting the bug?
Cloudflare said it found no evidence of deliberate exploitation. It described the affected requests as consistent in timing and volume with ordinary long-context use; that is the company’s assessment of the incident data.
Why is Jump Crypto charging a deposit for bug reports?
Jump Crypto’s contest received 809 reports that reduced to 127 unique findings. The company believes AI agents found or wrote nearly every submission, and its new platform requires a 1 SOL deposit per report. The source material does not yet show how the fee will affect report quality or participation.
Source: ThorstenMeyerAI.com
