🔍 Read the full analysis: The AI Answer That Appeared In A Stranger’s Cloudflare Session on ThorstenMeyerAI.com
Get smart everyday buys delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The company traced the issue to a context-window configuration mismatch combined with a bug in the SGLang inference engine, and says it took the model offline and restored a fixed version on Sept. 9. Its report says it found no evidence of deliberate exploitation, but does not explain how affected customers were notified.
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The company’s Oct. 26 incident report attributes the exposure to a mismatch in its service configuration combined with a bug in the open-source SGLang inference engine; Cloudflare says it took the model offline during the response and restored a fixed version that evening.
Cloudflare’s report says the issue affected only requests longer than 681,280 tokens. The model was configured to accept prompts as large as 1,048,576 tokens, but the memory pool used to hold prompt-processing data could not accommodate requests above the lower threshold. Cloudflare says the configuration mismatch and SGLang’s handling of rejected requests combined to produce responses containing data left in memory from other sessions.
The incident was reported on Sept. 8 through Cloudflare’s HackerOne program by security researcher Gadi Evron of Knostic. Cloudflare’s timeline says it began verification the following morning, declared an incident at 13:22 UTC and took the model offline 38 minutes later. It restored a fixed version later that evening. The report says the 155 figure excludes Cloudflare’s own tests and the researcher’s requests.
Cloudflare said it found no evidence that someone deliberately exploited the flaw. It assessed the remaining requests as consistent in their timing and volume with ordinary long-context use. That is the company’s assessment, rather than an independently established account of every affected request. The incident report, as described in the supplied source material, does not say how Cloudflare notified customers whose request data may have appeared in responses to other users.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why Cross-Customer Text Exposure Matters
The incident shows how a failure in the infrastructure serving an AI model can expose customer data even when the model itself is not the source of the defect. Cloudflare’s report points to memory handling and request validation across a split inference system: one GPU pool processes prompts and another generates answers. The leak arose when those components disagreed about whether a request had been rejected.
For customers, a response that looks coherent may still contain material that did not come from their own prompt. Cloudflare says the affected requests were exceptionally long, which narrows the known trigger but does not remove the privacy concern for users of that endpoint. The report also highlights a testing gap: Cloudflare says its pre-launch checks at long context lengths verified response codes and engine performance, but did not validate the output’s content and coherence.
The episode also places pressure on hosted AI providers to test failures at system boundaries, not just whether an endpoint returns a successful status. Cloudflare’s stated finding of no deliberate exploitation is relevant, but customers still need clear information about exposure scope, notification and any follow-up safeguards to evaluate their own risk.
Products Worth Considering
Dell XPS 13 9350 Laptop, 13.4 FHD+ Display, Intel Ultra 7 256V, 16GB DDR5, 1TB SSD
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Dell XPS 13 9350 AI Professional Laptop 13.4 120Hz FHD+ Display
As an affiliate, we earn on qualifying purchases.
How the KV Cache Failure Occurred
When a language model processes a prompt, it stores intermediate calculations called a key-value cache, or KV cache, so it can generate later text without repeatedly processing the entire prompt. Cloudflare says its system used pools of fixed-size memory pages for this data. Those pages were not cleared between requests; the system relied on the next request overwriting them. Cloudflare described that approach as common and useful for performance.
The reported failure involved two faults. Cloudflare had advertised a 1,048,576-token context window even though the prefill memory pool could hold 681,280 tokens. Separately, SGLang marked an oversized request as rejected and replaced it with a one-token placeholder. In Cloudflare’s split prefill-and-decode setup, queues checked whether the request had finished, but not whether it had been rejected. According to the report, the decode side then read reserved pages that prefill had not overwritten, allowing older prompt text and partial generations to appear in the response.
Cloudflare says the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but that it noticed the report only while investigating this incident. The source material also describes a separate AI security concern: a Jump Crypto audit contest produced hundreds of reports that the firm said were largely generated or found by AI agents. That development concerns the burden of reviewing vulnerability reports; it is not evidence about the Cloudflare incident or its cause.
““Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notifications and Exposure Scope
Cloudflare counted 155 affected responses after excluding its own tests and the researcher’s activity, but the supplied account does not identify how many customers were involved, what kinds of information appeared, or whether any customer data was retained or used beyond those responses. It also does not say whether or when potentially affected customers were notified.
The company says it found no evidence of deliberate exploitation and that the requests were consistent with normal long-context use. The report does not establish the identity or intent of all users whose requests triggered the issue. Nor does the available material detail the full remediation, independent verification, or whether Cloudflare found similar weaknesses in other models or services.
What Cloudflare Has Yet to Detail
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of Sept. 9 after taking the service offline. The supplied report does not set out a further public milestone or say whether additional technical findings will be released.
Readers and affected customers will be looking for details about customer notification, the number of accounts involved, and what checks now prevent oversized or rejected requests from reaching the decode stage. Cloudflare’s report also points to the need for output-level testing at long context lengths. Whether the company will publish additional validation or an account of customer follow-up remains unclear.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The company attributed the issue to a configuration mismatch and a bug in SGLang.
Which requests could trigger the problem?
According to Cloudflare, the affected responses followed prompts longer than 681,280 tokens. That was below the service’s advertised context window of 1,048,576 tokens but above the capacity of the relevant memory pool.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and that the activity it reviewed was consistent in timing and volume with ordinary long-context use. That is the company’s assessment; the supplied material does not identify every user behind the affected requests.
Were affected customers notified?
The incident details provided here do not say how or whether affected customers were notified. Cloudflare’s report, as summarized in the source material, also does not provide the number of customers involved.
Source: ThorstenMeyerAI.com
