🔍 Read the full analysis: The Cloudflare Bug That Linked AI Answers To Stranger Sessions on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The issue affected prompts longer than 681,280 tokens and resulted from a Cloudflare configuration mismatch combined with a bug in the SGLang inference engine. Cloudflare says it found no evidence of deliberate exploitation; customer notification details were not included in the report.
Cloudflare says its hosted GLM-5.3 AI service returned 155 responses containing text from other customers’ requests during a 14-day period, after a configuration mismatch and a bug in the open-source SGLang inference engine combined. The company’s incident report, published October 26, says the issue affected requests with prompts longer than 681,280 tokens; Cloudflare says it found no evidence that anyone deliberately exploited it.
The affected endpoint was @cf/zai-org/glm-5.3, a text-generation model made by Z.ai and hosted through Cloudflare Workers AI. Cloudflare’s report says the affected responses occurred between August 27 and September 9, 2026. It counted 155 responses that contained data from other customers’ requests. After excluding its own tests and the researcher’s activity, Cloudflare said the remaining requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw.
The incident was reported on September 8 through Cloudflare’s HackerOne vulnerability program by security researcher Gadi Evron of Knostic. Cloudflare’s timeline says verification began the following morning, and the company declared an incident at 13:22 UTC. It took the model offline 38 minutes after declaring the incident and restored a fixed version later that evening, according to the source report.
Cloudflare attributed the incident to two faults operating together. Its configuration advertised a 1,048,576-token context window, while the memory pool available for the model’s key-value cache could hold 681,280 tokens. A SGLang bug then allowed requests that could not fit to move through a split processing setup rather than being rejected. Cloudflare said it had expected the engine to return an error for oversized prompts, but its pre-launch checks tested response codes and performance without checking the generated output’s coherence.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why Cross-Session Text Matters
The incident involved a boundary between customers’ requests, not simply an inaccurate or fabricated model answer. If one customer’s response contains text submitted by another, that can expose information users expected to remain within their own session. The report does not identify the contents of the leaked text or whether it included sensitive personal, business, or technical information, so the nature and practical consequences of the exposed material remain unestablished.
The failure also illustrates how a hosted model’s privacy depends on the inference software and service configuration around the model, not just the model itself. Cloudflare attributed the problem to its memory-pool settings and SGLang’s handling of rejected requests; the source report says the GLM model itself was not at fault. For organizations using long-context AI services, the case makes output validation and isolation between requests relevant parts of assessing service risk.
There is a second security concern in the source report: the growing volume of AI-generated vulnerability submissions can make it harder to identify valid issues. That is a separate development from Cloudflare’s data exposure, not a cause of this incident. Together, the examples point to pressure on both sides of security work: systems must be tested for cross-user failures, while security teams must sort credible reports from a larger volume of submissions.
Products Worth Considering
Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
How Cache Capacity Became a Leak
When a language model processes a prompt, it stores intermediate values known as a key-value (KV) cache so it can generate later tokens without repeatedly processing the entire prompt. Cloudflare says cache memory was divided into fixed-size pages and that pages were not cleared between requests; the next request was expected to overwrite them. Under normal operation, the inference engine’s tracking should keep a request from reading pages belonging to another one.
Cloudflare ran GLM-5.3 in a disaggregated setup: one group of GPUs processed prompts and created cache data, while another group generated responses. According to the report, the prefill side marked a prompt that exceeded available cache capacity as rejected and substituted a one-token placeholder. The two processing queues checked whether a request was finished, but not whether it had been rejected. On the decode side, memory had been reserved for the full prompt, so it read pages that the prefill stage had not overwritten. Cloudflare says those pages still held other users’ prompts and partial generations.
The response could still appear successful: the client received HTTP 200, and the token count matched the long prompt, according to the report. Cloudflare says the underlying SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but the company only noticed it during its investigation. Separately, the source article describes a $1 million Firedancer audit contest that generated 809 reports from 162 researchers and 127 unique findings; Jump Crypto reportedly believes AI agents found or wrote nearly all of them. That contest highlights triage pressure, but it is not connected to the Cloudflare incident.
““we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.””
— Cloudflare incident report
Questions About Customer Exposure
Cloudflare’s report gives the number of affected responses, but the supplied material does not say how many customers were affected, what kinds of information appeared in the responses, or whether any recipients recognized or retained the text. It also does not explain how or when affected customers were notified. Those gaps limit what can be said about the scope and consequences of the exposure.
Cloudflare said it found no evidence of deliberate exploitation, but that statement does not establish who may have seen each response or whether data was copied beyond the service. The report also does not provide a detailed independent review of the remediation or say whether the fix has been evaluated by an outside party. These points remain unknown in the source material.
Disclosure and Safeguard Follow-Up
The immediate service response described in the report is complete: Cloudflare took the affected model offline after declaring an incident and brought back a fixed version that evening. The source material does not give a date for further technical disclosures or outline additional public milestones. Readers and customers will need to look for follow-up from Cloudflare on customer notification, the scope of affected data, and measures added to prevent similar cross-request reads.
The case also leaves practical questions for service providers: whether long-context outputs are checked beyond successful HTTP responses, how rejected requests are handled across distributed processing queues, and how cache pages are protected between users. Cloudflare’s report identifies the configuration mismatch and SGLang behavior it says caused this incident, but the supplied account does not confirm whether those safeguards have been adopted across other models or services.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 service returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a memory-capacity mismatch and a bug in SGLang’s handling of oversized prompts.
Which prompts could trigger the issue?
According to Cloudflare, the affected requests had prompts longer than 681,280 tokens, the capacity of the relevant KV-cache pool. Its advertised context window was 1,048,576 tokens.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and described the remaining affected requests, after excluding testing and researcher activity, as consistent with ordinary long-context use. That is the company’s assessment in its incident report.
What information was exposed, and were customers notified?
The supplied report summary does not identify the contents of the text or explain how affected customers were notified. The number of customers affected and the sensitivity of any exposed material are also unclear from the source material.
Was the AI model itself responsible?
The source report says the GLM-5.3 model itself did nothing wrong. Cloudflare attributed the incident to its configuration and a bug in the SGLang inference engine used to process requests.
Source: ThorstenMeyerAI.com
