🔍 Read the full analysis: The Bug Hunting Challenge Behind Cloudflare’s AI Spam Flood on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare says a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 service to return 155 responses containing other customers’ request data between August 27 and September 9, 2026. Separately, a Jump Crypto audit contest received 809 submissions that the company says largely involved AI agents; the two cases highlight the challenge of finding real security issues amid a surge in AI-assisted reports.
Cloudflare disclosed that its hosted GLM-5.3 AI model returned 155 responses containing data from other customers’ requests over a 14-day period, after a configuration mismatch and an inference-engine bug combined to expose GPU memory. The disclosure arrives amid a separate debate over AI-written vulnerability reports: Jump Crypto says a contest drew 809 submissions but only 127 unique findings, underscoring the growing work required to distinguish actionable bugs from automated noise.
Cloudflare’s incident report, published October 26, says the affected service was the GLM-5.3 model on Workers AI. The company found that responses leaked data between August 27 and September 9, 2026. Only prompts longer than 681,280 tokens could trigger the issue. Cloudflare said it found no evidence of deliberate exploitation and that the affected requests appeared consistent in timing and volume with ordinary long-context use.
The incident involved two faults. Cloudflare configured a context window of 1,048,576 tokens, while the memory pool used to store the model’s intermediate computations had space for 681,280. A bug in the open-source inference engine SGLang then allowed a rejected, oversized request to continue through a split processing system. The decoding stage could read memory pages that had not been overwritten and still contained data from earlier requests.
Researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it declared an incident the following day and took the model offline 38 minutes later, then restored a fixed version that evening. In a separate example of the reporting pressure facing security programs, Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers. Jump said those reports amounted to 127 unique findings and that it believes AI agents found or wrote nearly all of them.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Security Review Faces Two Pressures
The Cloudflare incident shows how a failure in infrastructure around a model can create a customer-data exposure even when the model itself is not the cause. Cloudflare’s report attributes the leak to its configuration and SGLang’s request handling, not to a flaw in GLM-5.3. The memory pages were not cleared between requests; the system relied on later requests fully overwriting them, making correct queue and capacity handling central to keeping customers’ data separate.
The Jump Crypto contest points to a different security challenge: more reports do not necessarily mean more distinct vulnerabilities. AI tools can make it easier and cheaper to generate submissions, but researchers and program operators still have to verify each claim, remove duplicates and identify exploitable issues. Jump’s new bounty platform charges researchers 1 SOL per report, about $100 according to CoinDesk, in an effort to discourage low-value submissions. That approach may reduce volume, but it also raises questions about whether a fee could deter legitimate researchers.
Together, the cases show why security teams need to manage both sides of AI’s effect on vulnerability work: protecting systems that run models and preserving the capacity to review reports about flaws. The immediate consequences differ, but in each case, reliable checking and validation matter as much as the speed of automated systems.
Products Worth Considering
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Dell UltraSharp U2725QE 27-Inch 4K UHD IPS Black Monitor
As an affiliate, we earn on qualifying purchases.
How the Leak and Report Surge Emerged
Cloudflare’s model used a disaggregated setup: one group of GPUs processed prompts and built a key-value cache, while another generated responses using that cache. When a prompt exceeded available memory, SGLang marked it as rejected and substituted a one-token placeholder. In this setup, however, the queues checked whether a request had finished, not whether it had been rejected. The decoding stage therefore treated the request as valid and could read pages left over from other users.
Cloudflare said it had known about the difference between the advertised context window and the smaller memory pool before launch. It expected the engine to return an error for requests that did not fit. The company’s report says its long-context tests checked HTTP response codes and engine performance but did not validate the output or its coherence. Cloudflare also said the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but that it noticed the issue only during its investigation.
The contest figures sit within a wider rise in security-report volume. The source report says curl ended its bug bounty program in January 2026, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions that month. Those figures do not establish how many submissions were AI-generated or how many were valid; they illustrate the volume that programs may need to triage.
“We only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.”
— Cloudflare, in its incident report
What the Reports Do Not Establish
Cloudflare’s report gives a count of 155 affected responses, but the provided material does not say how many customers or individual requests were affected, what kinds of data appeared in the responses, or whether customers were notified and when. The company’s statement that it found no evidence of deliberate exploitation describes its investigation; it does not establish who sent every triggering request.
It is also unclear whether the leak affected any other model or service, or whether the SGLang bug was exploitable under configurations other than the one Cloudflare described. The source material does not include an independent technical review of the incident or a detailed account of the fixed version’s testing.
Jump Crypto’s assessment that AI agents found or wrote nearly every contest finding is the company’s view. The material does not explain how it determined which tools were used, how many of the 127 findings were valid or severe, or whether the new fee has changed submission quality. The broader submission figures also do not provide a consistent breakdown of AI-generated, duplicate and actionable reports.
Follow-Up on Fixes and Triage
Cloudflare says it fixed the affected model and restored service on the evening of September 9. The incident report provides the company’s account of the failure and response, but the material does not identify a further public milestone, such as a customer-notification update or an independent review. Those details would help clarify the scope of the exposure and how the safeguards were tested after the fix.
For vulnerability programs, the next test will be whether measures such as Jump Crypto’s 1 SOL submission charge reduce duplicate or low-quality reports without excluding researchers with valid findings. Program operators will also need ways to assess submissions on their technical merits as the use of AI tools grows. No results from Jump’s new fee system are included in the source material.
Key Questions
What happened to Cloudflare’s GLM-5.3 service?
Cloudflare says the hosted model returned 155 responses containing other customers’ request data between August 27 and September 9, 2026. The company attributed the issue to a memory-capacity mismatch and a bug in SGLang.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the requests as consistent with ordinary long-context use. That is the company’s finding, not an independent determination about every request.
How did Cloudflare respond?
A researcher reported the issue through HackerOne on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident, fixed the issue and restored service that evening.
Why are AI-generated bug reports a concern?
AI tools can produce or assist with submissions at high volume, while security teams still have to check whether each report is distinct, valid and actionable. Jump Crypto said its contest received 809 submissions that reduced to 127 unique findings.
What is Jump Crypto charging for reports?
Jump Crypto’s new bounty platform charges 1 SOL per report, which CoinDesk valued at about $100. The source material does not report whether the fee has reduced low-quality submissions or affected legitimate reporting.
Source: ThorstenMeyerAI.com
