🔍 Read the full analysis: The AI Session Leak And Spam Surge Cloudflare Bug Hunters Faced on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. In a separate development, a Jump Crypto audit contest received 809 reports that were distilled to 127 unique findings, underscoring the growing workload of evaluating AI-assisted submissions.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests during a 14-day period, while a separate crypto audit contest highlighted a surge in AI-assisted bug submissions. The incidents point to two distinct security challenges: preventing data exposure in AI services and sorting genuine vulnerabilities from a growing volume of reports.
Cloudflare said the leak affected requests sent to its Workers AI GLM-5.3 endpoint from August 27 through September 9. Its incident report attributed the issue to a mismatch between the model’s advertised 1,048,576-token context window and a memory pool sized for 681,280 tokens, combined with a bug in the open-source SGLang inference engine. According to Cloudflare, only prompts exceeding 681,280 tokens could trigger the problem.
A researcher reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare said it declared an incident the following day and took the model offline 38 minutes later, then restored a fixed version that evening. The company reported 155 affected responses and said it found no evidence of deliberate exploitation. It said the requests, after excluding its own testing and the researcher’s activity, were consistent in timing and volume with ordinary long-context use.
Separately, Jump Crypto’s $1 million Firedancer audit contest drew 809 reports from 162 researchers, according to the supplied source material. The submissions were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every report, and its new bounty platform requires researchers to stake 1 SOL per submission, worth about $100 at the cited CoinDesk estimate. The contest’s figures describe a separate program, not the Cloudflare incident.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on AI Security
The Cloudflare incident shows that a model’s ability to accept very long prompts can depend on several layers working together: service configuration, memory handling and inference-engine logic. Cloudflare said the leak required an unusually long prompt and a particular interaction between its split prefill-and-decode setup and SGLang. Even a limited set of affected responses matters because the returned text included material from other customers’ requests.
The report also identifies a testing gap. Cloudflare said it had checked HTTP responses and engine performance during long-context testing but had not checked the output’s coherence. That distinction matters to operators of hosted AI services: a successful response code does not by itself show that the service returned only the requesting customer’s data.
The Jump Crypto figures show a different operational strain. More submissions can help surface flaws, but reviewers must distinguish unique, useful findings from duplicates or low-quality reports. The source material also describes other signs of pressure: curl ended its bug bounty in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures are not directly comparable measures of vulnerability quality, but they indicate why triage capacity has become a concern.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
DJI Osmo Mobile 8 3-Axis Smartphone Gimbal Stabilizer
LG UltraGear 32GX850A-B 32-Inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
Cloudflare’s incident report describes a key-value (KV) cache used to retain a model’s intermediate calculations while it processes a prompt. The cache occupies GPU memory, which an inference engine divides into pages that requests can use. Cloudflare said those pages are not zeroed between requests; instead, the next request is expected to overwrite them. That practice is used for performance, but it makes correct allocation and tracking essential to keeping requests separate.
Cloudflare said its service separated prompt processing, called prefill, from response generation, called decode. When a prompt exceeded the available pool, SGLang marked it rejected and replaced it with a one-token placeholder. In the split setup, however, the queues checked whether processing had finished but not whether the request had been rejected. Cloudflare said decode then read pages reserved for the full prompt even though prefill had written only one, exposing stale page contents in some responses.
The company said it had expected oversized prompts to produce errors and had observed successful responses in long-context tests. It also said the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but Cloudflare became aware of it during its investigation. The model itself was not identified as the cause in the report; the described failures involved service configuration and inference-engine handling.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
Customer Notifications and Exposure Scope
Cloudflare’s report, as summarized in the supplied material, does not say how affected customers were notified or provide details about the content of the 155 responses, such as how much text was exposed in each. It also does not establish whether any customer acted on text from another request before the issue was fixed. Cloudflare said it found no evidence of deliberate exploitation, but that statement does not identify every person or system that may have received affected output.
The precise impact on each customer and whether the reported count includes every potentially exposed response are not clarified in the material provided. For the Jump Crypto contest, the source says Jump believes AI agents found or wrote nearly every report; it does not provide a method for determining AI involvement or a breakdown of how many of the 127 unique findings were valid, severe or actionable.
Fixes and Triage Policies Ahead
Cloudflare said it restored a fixed version of the model on the evening of September 9 after taking the endpoint offline. The published incident report provides the company’s account of the timeline and technical cause; the supplied material does not identify a further public milestone or say whether Cloudflare plans additional disclosure about customer notifications. Readers should look for any follow-up from Cloudflare that clarifies customer communications and the scope of affected data.
On the bug-report side, Jump Crypto’s 1 SOL submission stake is a policy response intended to change the cost of filing reports. Its effect on the number and quality of submissions is not yet established by the figures provided. The wider issue for bounty operators is whether screening rules and review capacity can keep pace with AI-assisted reporting without discouraging researchers who find real flaws.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare said its hosted GLM-5.3 service returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. It attributed the issue to a configuration mismatch and an SGLang inference-engine bug.
Which prompts could trigger the leak?
Cloudflare said the issue could be triggered only by prompts longer than 681,280 tokens, the size of the relevant KV memory pool.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and that the requests it assessed were consistent with ordinary long-context use. That is the company’s finding, not proof that every possible exposure has been identified.
What does the Jump Crypto audit contest have to do with the leak?
The contest is a separate development. It received 809 reports from 162 researchers, which were reduced to 127 unique findings. The comparison highlights review workload, but it is not part of the Cloudflare incident.
How is Jump Crypto responding to the report volume?
Jump’s new bounty platform requires researchers to stake 1 SOL per report, valued at about $100 in the cited source. The supplied material does not yet show how this rule will affect submission volume or report quality.
Source: ThorstenMeyerAI.com
![Claude Code Reads AGENTS.md Only When Telemetry Is On [Fixed]](https://smartcr.org/wp-content/uploads/2026/09/claude-code-reads-agents-md-only-when-telemetry-is-on-fixed-featured-560x300.jpg)
