🔍 Read the full analysis: The AI Spam Flood Behind A Difficult Bug Hunting Search on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. In a separate security-audit example, Jump Crypto says AI agents likely found or wrote nearly all reports submitted to a Firedancer contest, leaving reviewers to sort 809 submissions into 127 unique findings.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a 14-day period. A separate Jump Crypto audit contest offers a contrasting security problem: the company received 809 submissions that it says were reduced to 127 unique findings, with AI agents likely responsible for nearly all the reports. Together, the cases show how AI can create both security risks in deployed services and more work for the people reviewing bug reports.
Cloudflare traced the leak, which ran from August 27 to September 9, to a mismatch in its configuration combined with a bug in the open-source inference engine SGLang. The affected endpoint was its hosted @cf/zai-org/glm-5.3 model on Workers AI. According to Cloudflare, only prompts longer than 681,280 tokens could trigger the issue, despite the service advertising a context window of 1,048,576 tokens.
The incident involved the model’s key-value cache, a store of intermediate data used to generate responses. Cloudflare said cache pages were not cleared between requests, a practice it described as common and useful for performance. When a too-long prompt was rejected in one part of its split inference setup, a queue in another part checked whether the request had finished but not whether it had been rejected. That allowed decoding to read cache pages that still contained data from other requests. Cloudflare says the affected responses returned HTTP 200 and could appear coherent.
Security researcher Gadi Evron of Knostic reported the issue through HackerOne on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It found no evidence of deliberate exploitation, and says the affected requests appeared consistent in timing and volume with ordinary long-context use. Separately, Jump Crypto’s $1 million Firedancer audit contest drew reports from 162 researchers. Jump says those 809 reports amounted to 127 unique findings and believes AI agents found or wrote nearly every submission.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Costs of AI-Assisted Security
The Cloudflare incident matters because it involved customer data crossing request boundaries in a hosted AI service. A customer submitting an unusually long prompt could receive text associated with another customer’s request. Cloudflare’s report gives a count of affected responses and a technical explanation, but does not state how many customers were affected or describe how they were notified.
The audit example points to a different pressure on security teams: generating bug reports has become cheaper, but validating, deduplicating and investigating them still takes human time. Jump’s contest figures do not establish that AI-generated reports were invalid; the company’s reported 127 unique findings came from 809 submissions. But the gap between submissions and unique findings shows why raw report volume is a poor measure of useful security work.
For service operators, the leak underscores the need to test what a model returns—not just whether an inference request completes successfully. For bounty programs and researchers, the challenge is maintaining useful disclosure channels when automated tools can produce reports at scale.
Products Worth Considering
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
From Cache Handling to Report Volume
Cloudflare said it had tested long-context requests before launch, but those tests checked HTTP response codes and engine performance without validating the output’s content and coherence. The company’s account says the configuration mismatch was known before launch; it expected the engine to return an error for prompts that exceeded available cache capacity.
The SGLang issue involved in the incident had been reported publicly as issue #30233 on July 6, 2026, according to Cloudflare, which says it noticed that report during its investigation. The source material identifies the failure as an interaction between Cloudflare’s configuration and SGLang’s handling of rejected requests in a disaggregated setup—not a flaw in the GLM model itself.
The report-submission problem has also appeared elsewhere. The source account says curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures describe separate programs and periods; they do not by themselves measure how many reports were AI-written or valid. Jump’s new bounty platform reportedly requires researchers to spend 1 SOL, about $100 according to CoinDesk, per report.
““we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.””
— Cloudflare incident report
Customer Impact Still Undetailed
Cloudflare’s report counts 155 affected responses, but the provided account does not say how many customers or distinct requests were involved, what types of information appeared in the responses, or how affected customers were notified. The company says it found no evidence of deliberate exploitation; that is its finding, not proof that no one could have encountered the issue.
It is also unclear from the available material whether the mismatch or SGLang bug affected any other models or deployments. For Jump’s contest, the reported submission and finding totals do not specify how many reports were generated entirely by AI, how many were human-written with AI assistance, or how the 127 unique findings were judged for severity.
Follow-Up on Fixes and Reviews
Cloudflare says it restored a fixed version of the model on the evening of September 9, after taking it offline during the response. The supplied report does not describe a further public milestone or state whether the company plans to change cache clearing, long-context admission checks or customer notification practices. Those details would help clarify how the service will prevent similar cross-request exposure.
For security contests, Jump’s report fee is one approach to reducing low-value volume, but the source material does not establish whether it will improve the proportion of actionable findings or discourage legitimate researchers. The next useful measures will be how programs distinguish duplicate and invalid submissions from verified bugs, and whether AI-assisted reporting can be handled without making disclosure harder.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The issue required prompts longer than 681,280 tokens and involved a configuration mismatch and an SGLang bug.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation. Its report described the timing and volume of affected requests as consistent with ordinary long-context use. The report’s finding does not establish who may have seen particular responses.
Was the GLM-5.3 model itself responsible for the leak?
Cloudflare attributed the incident to its configuration and the inference engine’s handling of rejected requests. The source account says the model itself was not at fault.
What does Jump Crypto’s audit contest show about AI bug reports?
Jump Crypto received 809 submissions from 162 researchers for its Firedancer contest and said they boiled down to 127 unique findings. Jump believes AI agents found or wrote nearly every report, but the available information does not specify how many were fully AI-generated or how many were valid.
What remains unknown about the Cloudflare impact?
The published details provided here do not say how many customers were affected, what categories of data appeared in responses, or how customers were notified. Cloudflare reported a fix and a lack of evidence of deliberate exploitation, but those impact details remain unclear.
Source: ThorstenMeyerAI.com
