🔍 Read the full analysis: Could Your AI Answer Show Up In Someone Else’s Session? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company says a capacity mismatch and an SGLang inference-engine bug caused the exposure, which it fixed after a researcher report; it found no evidence of deliberate exploitation. A separate AI security reporting problem is also emerging: a Firedancer audit contest drew hundreds of reports that Jump Crypto says were mostly generated or found by AI agents.
Cloudflare says a bug in its hosted GLM-5.3 AI service caused 155 responses to include text from other customers’ requests between August 27 and September 9, according to an incident report published October 26. The exposure affected requests with prompts longer than 681,280 tokens; Cloudflare says it took the model offline after investigating a researcher’s report, deployed a fix, and found no evidence of deliberate exploitation.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare’s review found that the affected responses came from the hosted endpoint @cf/zai-org/glm-5.3. The company said the requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the flaw. It did not identify the model itself as the cause.
Cloudflare’s report describes two faults that combined. Its configuration advertised a 1,048,576-token context window, while the memory pool used to store prompt-processing data had room for only 681,280 tokens. A bug in the open-source SGLang inference engine then allowed requests that exceeded capacity to move through a split processing system instead of being rejected cleanly. Some memory pages were not overwritten, allowing the decode stage to read data left by other requests.
The company’s timeline says it began verification on September 9, declared an incident at 13:22 UTC, and took the model offline 38 minutes later. It restored a fixed version that evening. The supplied report does not state how Cloudflare notified affected customers or how many distinct customers were involved.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
What Cross-Request Exposure Means
The incident shows how a failure in the systems surrounding an AI model can expose information even when the model itself is not at fault. Prompts and partial generations may contain source code, internal documents, personal information or other sensitive material. The reported exposure occurred in responses to exceptionally long prompts, but the report says those requests were consistent with normal use, not necessarily malicious activity.
For organizations using hosted AI, the episode raises practical questions about data isolation, incident disclosure and testing. Cloudflare says it validated response codes and performance during long-context tests but did not check model output and coherence. A successful HTTP response alone, the incident suggests, does not establish that a system returned only the data belonging to that request.
The report also describes a difficult trade-off in accelerator memory management. Reusing memory pages without clearing them can improve performance, but it makes correct request handling and isolation essential. Here, a capacity mismatch and a separate rejection-handling bug combined to bypass that protection.
Products Worth Considering
DJI Osmo Pocket 3 Filter Bundle – Vlogging Camera with 1 CMOS Sensor and 4K/120fps
Apple iPad Air 11-inch (M2), 512GB, Wi-Fi, Space Gray
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
As an affiliate, we earn on qualifying purchases.
How the Memory Bug Passed Requests
Language models use a KV cache to store intermediate information while processing a prompt and generating a response. In Cloudflare’s setup, one GPU pool processed prompts and built that cache; another pool generated answers. Memory was allocated in pages and reused between requests. Cloudflare says those pages were not cleared between users because the next request was expected to overwrite them.
According to the report, a prompt too large for the available pool should have been rejected. Instead, SGLang replaced it with a one-token placeholder. In the split setup, queues checked whether a request was finished but not whether it had been rejected. The second processing stage had reserved pages for the full prompt, read pages that the first stage had not rewritten, and returned a response that included leftover data. Cloudflare says the client received HTTP 200, making the reply appear successful.
Cloudflare says it knew about the difference between advertised context length and memory capacity before launch, but expected the inference engine to return an error for oversized prompts. It also says its long-context tests checked HTTP status and performance without validating output content. The report notes that an SGLang issue describing the bug had been filed on July 6, 2026, but Cloudflare says it noticed that report only during its investigation.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
Customer Impact Still Unspecified
Cloudflare reported 155 affected responses, but the material available does not specify how many customers or individual requests were involved, what kinds of information appeared, or whether any exposed content was accessed beyond the responses themselves. The company’s finding of no evidence of deliberate exploitation is not proof that the data was never seen or retained by recipients.
The report also does not explain how or when affected customers were notified, whether Cloudflare offered further steps to them, or whether independent reviewers have verified the incident findings. It is not clear from the supplied account whether other models or configurations using the same inference engine were affected. The described trigger was limited to prompts longer than 681,280 tokens on this endpoint, but the material does not establish that all other deployments were assessed.
Disclosure and Platform Follow-Up
Cloudflare says it restored a fixed GLM-5.3 version on the evening of September 9, after taking the endpoint offline and addressing the issue. The next questions for customers and security researchers are whether the company will provide more detail on customer notification and impact, and whether further reviews identify related exposure risks in other configurations.
The source material also describes a wider challenge for vulnerability programs: AI-generated submissions can increase the volume of reports faster than teams can verify them. It cites Jump Crypto’s $1 million Firedancer audit contest, which received 809 reports from 162 researchers and produced 127 unique findings; Jump believes AI agents found or wrote nearly every report. Those figures do not establish that AI caused Cloudflare’s incident, but they underline two separate pressures on security teams: preventing cross-customer data exposure and sorting valid findings from a growing volume of automated submissions.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses from its hosted GLM-5.3 service included text from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch combined with a bug in SGLang.
Which requests could trigger the exposure?
According to Cloudflare’s report, the affected requests had prompts longer than 681,280 tokens, the capacity of the relevant memory pool. The report does not describe exposure from shorter prompts.
Did Cloudflare say attackers deliberately exploited the bug?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of affected requests as consistent with ordinary long-context use. That is the company’s finding, not confirmation that no recipient saw exposed text.
Has Cloudflare said which customers were affected?
The supplied incident account gives the number of affected responses but does not say how many customers were involved or how they were notified. Those details remain unclear from the report material provided.
Is the incident connected to AI-written bug reports?
No connection is reported. The Firedancer audit contest is a separate example of AI’s impact on security work: Jump Crypto says its contest received 809 reports that yielded 127 unique findings and believes AI agents found or wrote nearly all of them.
Source: ThorstenMeyerAI.com
