🔍 Read the full analysis: What Happens When Cloudflare’s AI Cache Serves The Wrong Session? on ThorstenMeyerAI.com
Get business pricing on monitors, keyboards and dev gear
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says a configuration mismatch and an SGLang inference-engine bug caused its hosted GLM-5.3 model to return text from other customers’ requests in 155 responses over 14 days. The company took the model offline after a researcher’s report, restored a fixed version the same evening, and says it found no evidence of deliberate exploitation.
Cloudflare says a bug in its hosted GLM-5.3 service caused 155 responses to include text from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company traced the incident to a mismatch in its context-window configuration and a bug in the open-source SGLang inference engine; it says it found no evidence that anyone deliberately exploited the flaw.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on Sept. 8. According to Cloudflare’s incident report, only prompts longer than 681,280 tokens could trigger the leak. Cloudflare says the affected responses occurred over 14 days and, after excluding its tests and the researcher’s, were consistent in timing and volume with ordinary long-context use rather than repeated exploitation.
The service advertised a 1,048,576-token context window, but the memory pool used to store prompt-processing data had capacity for only 681,280 tokens. Cloudflare says it expected the inference engine to reject requests that exceeded the pool’s capacity. Instead, a bug in SGLang allowed an over-limit request to pass through part of the system as a rejected request represented by a one-token placeholder.
Cloudflare said its system used separate GPU groups to process prompts and generate replies. In this arrangement, the second group could read memory pages reserved for the full prompt even though the first group had written only the placeholder. Some pages still held material from other requests, and the generated response could include that text. Cloudflare took the model offline 38 minutes after declaring an incident, then restored a fixed version that evening, according to the report.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in inference-engine bookkeeping can become a privacy problem when a hosted service processes requests from different customers using shared GPU memory. The model did not need to be intentionally instructed to disclose another user’s information: under the specific conditions described by Cloudflare, memory associated with earlier requests could be read while forming a later response.
Cloudflare says the issue required an unusually long prompt, which narrows the set of requests that could trigger it. But the responses reportedly appeared coherent and returned an HTTP 200 status, so a successful response alone would not have signaled that another customer’s text was present. The incident also highlights a gap in Cloudflare’s pre-launch checks: the company says it tested response codes and performance at long context lengths without validating the model’s output and coherence.
For customers using hosted AI services, the report underscores that privacy depends on more than the model’s behavior. Configuration, memory allocation and software handling of rejected requests also affect whether one request remains isolated from another. Cloudflare’s disclosure gives customers a record of the incident, but the report does not state how affected customers were notified or what information appeared in the 155 responses.
Popular right now
Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
As an affiliate, we earn on qualifying purchases.
The Context-Window Mismatch
A language model stores intermediate information about a prompt in a key-value cache, or KV cache, so it can generate text without repeatedly processing the entire prompt. Cloudflare says this cache is held in GPU memory and divided into pages that requests borrow and return. Pages are not cleared between requests; the next request is expected to overwrite them. That practice can support performance, but it relies on the system assigning and tracking each page correctly.
Cloudflare described its GLM-5.3 deployment as a disaggregated setup: one group of GPUs processed prompts and built the cache, while another generated responses. In this setup, Cloudflare says, queues checked whether a request had finished but not whether it had been rejected. That allowed the placeholder request to proceed, while the generation side read pages reserved for the longer prompt. The company said a report of the SGLang bug had been filed as issue #30233 on July 6, 2026, but it noticed the issue only during its investigation.
The disclosure came in the same week as a separate concern about AI-generated security reports. The source account says Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which were reduced to 127 unique findings; Jump believes AI agents found or wrote nearly every report. That episode is distinct from Cloudflare’s leak, but both illustrate how AI systems can increase the volume of work while leaving people responsible for verification and review.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare’s incident report
Customer Exposure and Notice Remain Unclear
Cloudflare’s report identifies 155 affected responses, but the material provided does not specify how many customers were affected, what kinds of text appeared in the responses, or whether the information included personal, confidential or otherwise sensitive data. It also does not explain how Cloudflare notified customers who may have received or had text exposed through those responses.
The company says it found no evidence of deliberate exploitation, but that statement describes its findings, not proof that no one attempted to exploit the flaw. The source material does not provide details of an independent review or an account of whether customers confirmed the scope of exposure. Cloudflare’s report also does not fully establish whether every affected response was identified or what monitoring was used to reach the stated count.
The precise roles of Cloudflare’s configuration and the SGLang defect are described in the company’s incident account. The available material does not include a separate response from SGLang or a detailed account of the project’s follow-up to its earlier bug report.
Follow-Up on Customer Notifications
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of Sept. 9, after taking the model offline during the incident. The immediate next questions are whether the company will publish further details about customer notification and the scope of exposed text, and whether additional safeguards or tests have been added for long-context requests.
The reported SGLang issue may also draw attention to how inference systems handle rejected requests in split prompt-processing and generation setups. The incident report says the bug was previously filed in July and discovered by Cloudflare during its investigation; the available source material does not state what changes, if any, SGLang’s maintainers have made. Cloudflare’s account leaves those follow-up steps, as well as any further customer impact disclosures, unresolved.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 service returned text from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The company attributed the issue to a context-capacity mismatch and a bug in SGLang.
Which prompts could trigger the leak?
According to Cloudflare, the issue could be triggered only by prompts longer than 681,280 tokens. The service advertised a context window of 1,048,576 tokens, but its relevant memory pool had lower capacity.
Did Cloudflare find evidence of an attack?
Cloudflare says it found no evidence of deliberate exploitation. Its report says the affected requests, excluding its own tests and the researcher’s, were consistent with ordinary long-context use. That is the company’s assessment of the available evidence.
Has Cloudflare said which customers were affected?
The source material does not identify affected customers or say how many customers received responses containing other users’ text. It also does not specify what information appeared in those responses or how customers were notified.
Is the issue still active?
Cloudflare says it took the model offline after declaring an incident and restored a fixed version the same evening. The available report does not provide further detail about ongoing monitoring or any additional remediation.
Source: ThorstenMeyerAI.com
