🔍 Read the full analysis: The Cloudflare Leak That Raised Concerns About AI Session Mix-Ups on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The issue required prompts longer than 681,280 tokens and resulted from a Cloudflare configuration mismatch combined with a bug in the SGLang inference engine. Cloudflare says it found no evidence of deliberate exploitation, but its report does not explain how it notified affected customers.
Cloudflare says its hosted GLM-5.3 AI model returned text from other customers’ requests in 155 responses between August 27 and September 9, according to an incident report published October 26. The leak affected requests with more than 681,280 tokens and arose from a mismatch in Cloudflare’s memory configuration combined with a bug in the SGLang inference engine.
Cloudflare’s account says security researcher Gadi Evron of Knostic reported the issue through the company’s HackerOne program on September 8. His report said very long prompts sent to the hosted endpoint sometimes produced text belonging to other users’ sessions. Cloudflare’s investigation counted 155 affected responses over the 14-day period, excluding its own tests and the researcher’s requests.
The technical failure involved the model’s key-value (KV) cache, a store of intermediate information used while processing prompts and generating responses. Cloudflare’s prefill GPUs had memory for 681,280 tokens, while the advertised context window was 1,048,576 tokens. When a prompt exceeded available memory, SGLang marked it as rejected and replaced it with a one-token placeholder. In Cloudflare’s split prefill-and-decode setup, queues checked whether requests had finished but not whether they had been rejected.
As a result, the decode stage could read cache pages that the rejected request had not overwritten. Cloudflare says those pages still held other users’ prompts and partial generations. The service returned HTTP 200 rather than an error. Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The report says the company found no evidence of deliberate exploitation.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
How Cache Handling Exposed Requests
The incident matters because it involved cross-customer data in a hosted AI service, not merely an incorrect or low-quality model response. A user sending a long prompt could receive fragments of material supplied by other customers, potentially without recognizing that the response included another session’s data.
Cloudflare says KV cache pages are not cleared between requests; the next request is expected to overwrite them. That practice is used to support performance, but it depends on the inference system correctly tracking which pages belong to which request. Here, a configuration limit and a software-handling error failed together, allowing stale cache contents to reach a response.
The reported scope is bounded: Cloudflare identified 155 affected responses, and the trigger required prompts longer than 681,280 tokens. That does not establish that every response contained sensitive information or identify what specific customer data appeared. Still, the report highlights how infrastructure configuration, queue logic and output checks can affect privacy even when the underlying model itself is not the source of the fault.
Popular right now
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
Shark Rocket Pet Plus Corded Stick Vacuum, Bordeaux, HV322
As an affiliate, we earn on qualifying purchases.
The Two Faults Behind the Leak
Cloudflare described GLM-5.3 as a text-generation model from Z.ai designed for agentic coding. It said the model itself was not at fault. The relevant failure was in the service that processed its requests: Cloudflare’s advertised context size exceeded the available KV memory, and SGLang did not handle rejected requests safely in the company’s disaggregated setup.
Cloudflare said it knew about the configuration mismatch before launch and expected the inference engine to return an error for prompts that could not fit. It also said its long-context testing checked HTTP response codes and engine performance but did not verify model output and coherence. The SGLang issue involved in the incident had been reported publicly as issue #30233 on July 6, 2026; Cloudflare says it noticed that report during its investigation.
The incident report’s timeline says Evron’s HackerOne report arrived at 23:11 UTC on September 8. Cloudflare began verification at 08:00 the next morning and declared an incident at 13:22. The company then took the model offline, investigated and brought back a fixed version. The account is Cloudflare’s description of its own response and investigation.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare incident report
Customer Notification and Data Scope
Cloudflare’s published account does not say how affected customers were notified, whether all 155 responses contained identifiable or sensitive material, or what kinds of data appeared in them. The report gives a count of affected responses, not a count of affected customers or a description of the text each response exposed.
Cloudflare said it found no evidence of deliberate exploitation and assessed the timing and volume as consistent with ordinary long-context use. That is the company’s finding; the report does not establish that every affected request has been independently reviewed by outside investigators. It also does not provide details here about any regulatory notifications or further customer-level remediation.
Fixes and Further Disclosure
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of September 9 after taking the model offline. The next public questions are whether the company will provide further detail about customer notification, the affected data and remediation, and whether it has changed validation for other models or deployments using similar cache arrangements.
The report also points to a need to verify more than service availability and response codes when testing long-context requests. Further disclosure from Cloudflare, or independent analysis of the incident and fixes, could clarify how the safeguards now prevent rejected requests from reaching the decode stage with stale cache pages.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare says its hosted GLM-5.3 service returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch and an SGLang inference-engine bug.
Which requests could trigger the leak?
According to Cloudflare, the affected requests had prompts longer than 681,280 tokens. The service advertised a context window of 1,048,576 tokens, but the relevant prefill GPU memory pool could not hold that many tokens.
Was the GLM-5.3 model itself responsible?
Cloudflare said the model itself did nothing wrong. Its report describes a problem in the surrounding infrastructure: the cache capacity mismatch and how SGLang handled rejected requests in a split processing setup.
Did Cloudflare find evidence of an attacker exploiting the bug?
Cloudflare said it found no evidence of deliberate exploitation. It assessed the timing and volume of the requests, after excluding internal tests and the researcher’s activity, as consistent with ordinary long-context use.
What remains unknown?
The report does not explain how affected customers were notified, what specific kinds of data appeared in responses, or how many distinct customers were affected. It also does not detail any regulatory notifications or additional remediation for customers.
Source: ThorstenMeyerAI.com
