🔍 Read the full analysis: The AI Answer In A Stranger’s Session: Cloudflare’s Cache Bug Story on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 service returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. A configuration mismatch and an SGLang inference-engine bug combined to cause the exposure; Cloudflare says it found no evidence of deliberate exploitation.
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests during a 14-day period from August 27 to September 9, 2026. The company’s incident report, published October 26, attributes the exposure to a mismatch in its context-window configuration combined with a bug in the open-source SGLang inference engine; it says it found no evidence that anyone deliberately exploited the issue.
The problem affected requests sent to Cloudflare’s Workers AI GLM-5.3 endpoint. According to the company, every affected response followed a prompt longer than 681,280 tokens. The model was configured to accept a context window of 1,048,576 tokens, but the memory pool used to hold the prompt’s intermediate data had capacity for only 681,280.
Cloudflare said the mismatch was expected to produce an error, but SGLang did not handle the rejected request correctly in the company’s split prefill-and-decode setup. The decode stage could read memory pages that the prefill stage had not written for that request. Those pages still contained material from previous requests, and some of that material appeared in generated responses. Cloudflare described the affected material as other users’ prompts and partial generations.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare’s timeline says it verified the report the next morning, declared an incident at 13:22 UTC and took the model offline 38 minutes later. The company says a fixed version was restored that evening. It also said the 155 responses were identified across the incident period, excluding its own tests and the researcher’s requests.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a hosted AI service can expose customer data through the interaction of capacity settings and inference-engine logic, even when the model itself is not the source of the defect. Cloudflare says the GLM-5.3 model did not cause the leak; the failure occurred in the infrastructure managing the model’s memory between requests.
That distinction matters for organizations sending code, documents or other sensitive material to hosted models. A response may look coherent while containing content that came from another session, and the company said the only visible sign could be that the answer arrived faster than expected. The report also describes a testing gap: Cloudflare said it checked HTTP response codes and engine performance during long-context tests, but did not validate output and coherence. Successful service responses did not establish that the returned text was isolated correctly.
The broader security workload adds another concern. The source report says Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly every submission. That separate example is not evidence about Cloudflare’s incident, but it illustrates a pressure point for security teams: more reports can mean more triage work, while the quality and originality of AI-assisted reports remain contested.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How the Two-System Failure Worked
Large language models retain intermediate calculations from a prompt in what is called a key-value cache. In Cloudflare’s setup, GPU memory was divided into pages that requests could use and later return to a shared pool. The report says those pages were not cleared between requests; the system relied on correct bookkeeping and overwriting to prevent one request from reading another’s data.
Cloudflare ran the service in a disaggregated arrangement: one GPU pool processed prompts and built the cache, while another generated responses. In the reported failure, the oversized prompt was rejected and replaced with a one-token placeholder in the prefill stage. But the two queues checked whether a request had finished, not whether it had been rejected. The decode stage had reserved pages for the full prompt and read them despite the prefill stage writing only one. Unwritten pages retained earlier data, which could then enter the response.
Cloudflare said it knew about the context-window and memory-pool mismatch before launch and expected requests that exceeded the pool to return an error. It also said a related SGLang bug had been reported as issue #30233 on July 6, 2026, but the company noticed it only during its investigation. The incident report links the exposure to both the configuration mismatch and the software bug, rather than to a failure in the GLM model’s training or design.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notices and Exposure Scope
Cloudflare’s report gives a count of 155 affected responses, but the supplied account does not say how many distinct customers were affected or what specific types of information appeared in each response. It also does not explain how or when customers were notified. The company’s assessment that traffic resembled ordinary long-context use is not the same as proof that no one saw or used exposed material.
The report says Cloudflare found no evidence of deliberate exploitation, but it does not establish that every affected response was reviewed by a recipient or that all possible copies were identified. The available information also does not specify whether other models or endpoints shared the same configuration, or detail any independent review of the fix. Those points remain unclear from the source material.
What Cloudflare Must Clarify
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of September 9 after taking the service offline. The incident report is the latest public account of the event, but the supplied material does not identify a further release date, external audit or scheduled follow-up. The next developments to watch are any additional information from Cloudflare about customer notification, the number of affected accounts, the data involved and validation of the corrected system.
For customers assessing their exposure, the report’s stated trigger provides a specific starting point: requests longer than 681,280 tokens to the affected endpoint during August 27 through September 9. Cloudflare has not, in the supplied account, described a customer-facing lookup process or said whether it will publish a more detailed accounting. Any conclusions about the impact on particular users therefore depend on information the company has not publicly specified here.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses from its hosted GLM-5.3 service contained text from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a memory-capacity mismatch and an SGLang bug.
Which requests could trigger the exposure?
Cloudflare says every affected response followed a prompt longer than 681,280 tokens, the capacity of the relevant memory pool. The service had been configured with a larger context window of 1,048,576 tokens.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of affected requests as consistent with ordinary long-context use. That is the company’s assessment, not a finding that identifies every recipient or use of the exposed text.
Did Cloudflare say how customers were notified?
The incident account provided here does not say how affected customers were told, how many distinct customers were involved or what specific information appeared in each response.
Was the GLM-5.3 model itself responsible?
Cloudflare attributed the incident to its configuration and the SGLang inference engine, not to the GLM model itself. The failure involved how oversized requests were rejected and how shared GPU-memory pages were handled.
Source: ThorstenMeyerAI.com
