🔍 Read the full analysis: Could AI Spam Be Making Cloudflare’s Bug Hunter Work Harder? on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare said a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 model to return text from other customers’ requests in 155 responses between August 27 and September 9, 2026. Separately, a Jump Crypto audit contest received 809 reports that the company said were mostly found or written with AI, highlighting the growing cost of reviewing security reports. The two developments are related by the role of AI in security work, but the available information does not establish that report volume caused or contributed to Cloudflare’s leak.
Cloudflare disclosed that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026, after a researcher reported the issue. The disclosure comes amid a separate debate about AI-generated security submissions: Jump Crypto said nearly all reports in a major audit contest appeared to have been found or written by AI agents, adding to the work required to assess bug reports. The two cases illustrate different security pressures, but no evidence links the contest’s report volume to Cloudflare’s incident.
Cloudflare’s incident report, published October 26, says the leak affected its hosted @cf/zai-org/glm-5.3 endpoint. The responses were associated with prompts longer than 681,280 tokens. The company attributed the problem to a mismatch between its advertised context window of 1,048,576 tokens and the smaller memory pool available to process requests, combined with a bug in the open-source inference engine SGLang.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The company reported 155 affected responses across the 14-day period. After excluding its own tests and the researcher’s, Cloudflare said the requests appeared consistent with ordinary long-context use rather than repeated attempts to exploit the bug.
The separate audit example comes from Jump Crypto’s $1 million Firedancer contest, which drew 809 submissions from 162 researchers and yielded 127 unique findings. Jump believes AI agents found or wrote nearly every submission. The source report says the company’s newer bounty platform charges researchers 1 SOL per report, about $100 according to CoinDesk. That policy reflects a response to review costs, but the contest figures do not establish how many reports were low quality or how much time reviewers spent on them.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Security Teams Face More Review Work
The Cloudflare incident shows how a failure in serving infrastructure can expose one customer’s request content in another customer’s response. Cloudflare attributed the incident to two faults working together: an undersized memory pool relative to the advertised context window, and SGLang handling rejected requests incorrectly in a split processing setup. The disclosure matters to customers using hosted AI services because it raises questions about isolation, testing and how providers detect and communicate incidents.
The Jump Crypto contest points to a different operational problem. If automated tools make it much cheaper to generate or submit reports, security teams may face a larger queue without a matching increase in people able to verify findings. That can slow attention to valid vulnerabilities. The contest’s 127 unique findings also show why raw submission counts should not be treated as equivalent to confirmed bugs: 809 reports did not mean 809 distinct issues.
These developments are not evidence that AI-generated submissions caused Cloudflare’s leak, or that AI use itself caused the SGLang flaw. They instead show two separate ways AI changes security work: it is part of the software being operated, and it can produce material that human teams must review.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
How the Two Incidents Differ
Cloudflare’s report describes a KV cache, the intermediate data a language model stores while processing a prompt and generating a response. In the setup described by the company, GPU memory was divided into pages that could be reassigned between requests. Cloudflare said those pages were not cleared between users because the next request was expected to overwrite them.
Cloudflare said its prefill system reserved memory for a prompt that exceeded the available pool, while SGLang replaced the rejected request with a one-token placeholder. In the disaggregated setup, the queues checked whether a request had finished but did not check whether it had been rejected. The decode stage then read pages that had not been overwritten, allowing data from other requests to enter the response. Cloudflare said the customer received an HTTP 200 response, and that the output could appear coherent; the unusually fast response was the reported tell.
The report says the underlying SGLang issue had been filed as issue #30233 on July 6, 2026, but Cloudflare said it noticed that report only during its investigation. Elsewhere in the security industry, the source material cites curl ending its bounty in January, Bugcrowd banning “submission farming” in March, and HackerOne recording 46,947 submissions in March 2026. Those examples indicate concern about submission quality, but they are distinct programs and do not establish a single cause or trend across all platforms.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare, in its incident report
Customer Notices and Scope Remain Open
Cloudflare’s report, as summarized in the available source material, does not say how affected customers were notified, whether they received details about specific responses, or what further support was offered. It also does not provide a full breakdown of the 155 responses by customer or explain how many distinct customers were affected. The company said it found no evidence of deliberate exploitation, but that statement does not establish who received each response or whether every affected party has been identified.
The report also leaves open how Cloudflare changed its testing and safeguards beyond restoring a fixed version. It is unclear whether the changes include clearing reused memory, stricter rejection checks, or additional output validation. The source material does not provide a detailed independent assessment of the fix.
For the Jump Crypto contest, the claim that AI agents found or wrote nearly every report is the company’s assessment. The available figures do not give a detailed breakdown of AI use, report quality, reviewer hours or the share of unique findings that were independently verified. The broader examples of changing bounty policies and submission counts also do not, by themselves, measure the overall effect of AI on security research.
Follow-Up on Fixes and Reporting Rules
Cloudflare’s immediate next step, according to its report, was to restore a fixed GLM-5.3 version on the evening it declared the incident. The available account does not identify a further public milestone or date. Customers and security observers will be looking for more detail on notification, the scope of affected accounts, and whether the company will publish additional information about the fix and its testing.
For vulnerability programs, Jump Crypto’s per-report charge is one example of a platform response to increased submission volume. Whether such fees, stricter submission rules or other review measures will improve signal without discouraging valid research remains to be seen. Future contest disclosures with clearer data on duplicate reports, confirmed findings and review time would help distinguish higher volume from higher security value.
For now, the confirmed record is narrower: Cloudflare reported a specific cross-customer leak tied to long prompts and a combination of configuration and software errors, while Jump Crypto described an AI-heavy report pool in a separate audit. Further reporting is needed to establish the full customer impact and how security teams are adapting their review processes.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare said 155 responses from its hosted GLM-5.3 service contained text from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a memory configuration mismatch and an SGLang bug.
Which requests could trigger the leak?
Cloudflare said the affected responses were associated with prompts longer than 681,280 tokens. The advertised context window was 1,048,576 tokens, larger than the memory pool Cloudflare said was available in the relevant setup.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of requests, after excluding its own tests and the researcher’s, as consistent with ordinary long-context use.
How does the Jump Crypto contest relate to the leak?
The contest is a separate development, not a cause of the Cloudflare incident. Jump Crypto said AI agents found or wrote nearly all reports in its Firedancer audit contest, illustrating concerns about the workload involved in reviewing large numbers of submissions.
What remains unknown about the Cloudflare incident?
The available report summary does not say how affected customers were notified, how many distinct customers were involved, or provide a full account of the remediation and testing changes. Cloudflare’s published account may not include every detail of the response.
Source: ThorstenMeyerAI.com
