🔍 Read the full analysis: Could A Cache Leak Expose Your AI Conversation? on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The company attributed the incident to a context-window configuration mismatch combined with a bug in the SGLang inference engine; it says it took the model offline and found no evidence of deliberate exploitation. The same source report describes a separate rise in AI-generated vulnerability submissions that has led some programs to add costs or restrictions for reports.
In an incident report published Oct. 26, Cloudflare said the affected service was its hosted GLM-5.3 endpoint on Workers AI. The company counted 155 responses containing other customers’ data between Aug. 27 and Sept. 9. It said all affected requests involved prompts longer than 681,280 tokens. The report does not say how many customers were affected or describe the material exposed in each response.
Cloudflare traced the leak to two faults. Its configuration advertised a context window of 1,048,576 tokens, while the prefill GPUs’ memory pool for the model’s key-value cache could hold 681,280 tokens. Separately, the open-source SGLang engine did not properly handle an over-limit request in Cloudflare’s split prefill-and-decode setup. Cloudflare said the resulting response could include cache pages that still held other users’ prompt text or partial generations.
Security researcher Gadi Evron of Knostic reported the behavior through Cloudflare’s HackerOne program on Sept. 8, according to the report. Cloudflare said it reproduced the leak, declared an incident, took the model offline 38 minutes later and restored a fixed version that evening. The company said its review found no evidence that someone had deliberately exploited the flaw.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows that an AI service can return another customer’s text without the model itself being compromised. In this case, the risk arose in the infrastructure handling a model’s temporary memory: cache pages were reused without being cleared, and software that should have rejected an oversized request allowed it to proceed through part of the system.
That distinction matters for organizations sending sensitive code, internal documents or other confidential material to hosted AI tools. A coherent answer and a successful HTTP response do not, by themselves, establish that a request was handled correctly. Cloudflare said the leaked responses could appear coherent and that the request’s unusually fast completion was the only tell identified in its account.
The episode also points to a testing gap. Cloudflare acknowledged that before launch it tested response codes and engine performance at long context lengths, but did not validate the model’s output and coherence there. For customers, the incident underscores that provider-side safeguards and testing are part of the confidentiality boundary, alongside any protections in the model or user interface.
Popular right now
Roborock Q7 M5+ Robot Vacuum and Mop
Philips 3300 Series Fully Automatic Espresso Machine with LatteGo Milk System
Ninja SP151 Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel
As an affiliate, we earn on qualifying purchases.
The Cache Mismatch Behind the Incident
A key-value (KV) cache stores intermediate calculations a language model uses while processing a prompt and generating a response. The report says these cache pages are not cleared between requests; the next request is expected to overwrite them. Cloudflare described that approach as common and necessary for performance, making correct allocation and bookkeeping central to keeping requests separate.
Cloudflare’s GLM-5.3 service used separate GPU groups to process a prompt and generate its answer. According to the report, an over-limit request was marked rejected and replaced with a one-token placeholder, but queues in the split setup checked whether the request had finished rather than whether it had been rejected. The decode side had reserved cache space for the full prompt, while prefill wrote only the placeholder. It then read pages that still contained other users’ data.
The source report says a related SGLang issue had been filed as issue #30233 on July 6, 2026, though Cloudflare said it noticed that report only during its investigation. Cloudflare also said its long-context tests had produced successful responses despite the configuration mismatch, because they did not check output content and coherence.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare, in its incident report
Customer Notifications and Exposure Scope
Cloudflare’s published account does not specify how affected customers were notified, how many customers received affected responses, or what kinds of text appeared in those responses. The report gives a count of 155 responses, not a count of unique users or accounts. It also does not establish whether any exposed material was copied, retained or acted on by recipients.
The company said it found no evidence of deliberate exploitation, but that finding is not the same as proof that no one saw or used the leaked text. The source material does not provide an independent investigation or a detailed account of the evidence behind Cloudflare’s conclusion. It is also unclear from the material provided whether the SGLang issue has been fixed upstream or what other deployments might share the same conditions.
Fixes and Disclosure Follow-Up
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it took the service offline. Its incident report is the main public account in the source material; it does not describe additional customer notices, compensation or a separate follow-up review. Further detail from Cloudflare or affected customers could clarify the scope of the exposure and how the company handled disclosure.
The source report also describes a separate pressure on vulnerability-reporting programs: Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which Jump said amounted to 127 unique findings and that AI agents likely found or wrote nearly all of them. Jump’s new bounty platform requires a 1 SOL payment per report; CoinDesk was cited for an approximate value of $100. The report says curl ended its bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures concern separate programs and do not establish a direct connection to Cloudflare’s incident.
For the cache leak, the next meaningful updates would be any further account of customer notification, confirmed exposure scope and changes to testing or cache handling. Until those details are published, the confirmed record is limited to Cloudflare’s incident findings, the remediation it reported and its statement that it found no evidence of deliberate exploitation.
Key Questions
What happened to Cloudflare’s GLM-5.3 service?
Cloudflare says 155 responses from its hosted GLM-5.3 model included text from other customers’ requests between Aug. 27 and Sept. 9, 2026. It attributed the incident to a cache-capacity configuration mismatch and an SGLang bug.
Did the AI model itself cause the leak?
Cloudflare attributed the problem to its service configuration and the SGLang inference engine, not to a flaw in the GLM-5.3 model itself. The leak occurred as the system handled cache memory for oversized prompts.
What kinds of prompts were affected?
Cloudflare said all affected requests were longer than 681,280 tokens. Its report, as described in the source material, does not identify the contents of each exposed response or the number of customers involved.
Did Cloudflare find evidence of an attacker exploiting the bug?
Cloudflare said the requests’ timing and volume were consistent with ordinary long-context use and that it found no evidence of deliberate exploitation. That is the company’s assessment; the report does not provide an independent investigation.
Was the issue fixed, and were customers notified?
Cloudflare said it took the model offline after declaring an incident and restored a fixed version that evening. The published account described in the source material does not say how affected customers were notified.
Source: ThorstenMeyerAI.com
