🔍 Read the full analysis: What An AI Spam Flood Revealed About Bug Hunting At Cloudflare on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. A separate audit contest drew 809 submissions that Jump Crypto says largely involved AI agents, illustrating how AI can help find bugs while adding work to verify reports.
Cloudflare’s report says the issue affected requests to its Workers AI GLM-5.3 endpoint and could be triggered only by prompts longer than 681,280 tokens. On September 8, researcher Gadi Evron of Knostic reported that some long prompts returned text from other users’ sessions through Cloudflare’s HackerOne program. Cloudflare counted 155 affected responses across the 14-day period.
The company attributed the leak to two problems operating together. Its service advertised a context window of 1,048,576 tokens, while the key-value cache pool on prefill GPUs could hold 681,280. The SGLang bug allowed an oversized request that should have been rejected to move through queues in Cloudflare’s split prefill-and-decode setup. The decode stage then read cache pages that had not been overwritten and still contained other requests’ data.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. It reported no evidence of deliberate exploitation. The company also said affected requests were consistent in timing and volume with ordinary long-context use, rather than repeated attempts to exploit the flaw. Its account says the model itself was not at fault.
The second development is a reported $1 million Firedancer audit contest run by Jump Crypto. It received 809 reports from 162 researchers, which Jump said amounted to 127 unique findings. Jump believes AI agents found or wrote nearly all the submissions. Its new bounty platform requires researchers to spend 1 SOL per report; CoinDesk put that amount at about $100.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
When Bug Reports Outpace Review
Together, the incidents show two different security pressures created by AI systems. A model-serving flaw can expose information across customer requests, while AI-assisted vulnerability hunting can increase the number of reports that security teams must assess. Finding candidate bugs may be cheaper, but determining whether each report is valid, distinct and exploitable still takes expert review.
For customers, the Cloudflare case highlights the importance of isolation between requests in systems that reuse GPU memory for performance. For researchers and platform operators, the contest points to a growing screening burden: 809 submissions became 127 unique findings, according to Jump. That gap does not establish that the reports were useless, but it shows why submission volume alone is a poor measure of security value.
The responses described in the source suggest platforms are testing ways to reduce low-quality or repetitive reports. A per-report cost may deter submission farming, but it could also affect legitimate researchers who cannot afford repeated fees. The source does not provide results showing how Jump’s new fee changes the quality or volume of reports.
Products Worth Considering
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
Sony WH-1000XM4C Wireless Noise-Cancelling Headphones, Black
Apple AirPods Pro 3 Wireless Earbuds with Active Noise Cancellation
As an affiliate, we earn on qualifying purchases.
The Cache Mismatch Behind the Leak
Language models store intermediate calculations from a prompt in a key-value (KV) cache, allowing the system to generate responses without processing the entire prompt again at every step. Cloudflare said its cache pages were not cleared between requests; instead, the next request was expected to overwrite them. In this incident, the mismatch between the advertised context limit and available cache capacity interacted with an SGLang rejection-handling bug.
Cloudflare said it had expected oversized prompts to produce an error and had seen successful responses in long-context tests. It also acknowledged that those tests checked HTTP response codes and engine performance but did not validate output content and coherence. The report says the underlying SGLang issue had been filed as issue #30233 on July 6, 2026, but Cloudflare noticed it during its own investigation.
The audit contest forms part of a broader reported pattern of pressure on vulnerability-reporting programs. The source says curl ended its bounty program in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures are reported in the source material; they do not by themselves establish how many submissions were AI-generated or valid.
““The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.””
— Cloudflare incident report
Customer Notices and Exposure Scope
Cloudflare’s report gives a count of 155 affected responses, but the supplied account does not explain how the company identified every affected customer or whether each customer was notified. It also does not specify what kinds of customer information appeared in the responses, how many customers were affected, or whether any data was retained or used after being returned.
The company said it found no evidence of deliberate exploitation, but that is not the same as proof that no one attempted it. The source also does not include an independent review of Cloudflare’s investigation or details about the precise customer impact. For the audit contest, the share of reports actually written or discovered by AI remains Jump’s belief, rather than a verified breakdown.
Fixes and Review Policies Ahead
Cloudflare says it restored a fixed model version on the evening of September 9 after taking the endpoint offline. The supplied report does not describe further remediation milestones or state how customers were informed, so those details remain outstanding in the available account.
Attention will also turn to how bounty platforms handle AI-assisted submissions. Jump’s 1 SOL reporting fee is one stated response to high submission volume; its effect on report quality, researcher participation and duplicate reports is not yet known. Future contest results and platform policy updates may show whether fees and other screening measures reduce review workloads without deterring useful disclosures.
Key Questions
What happened in Cloudflare’s AI incident?
Cloudflare said its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the issue to a configuration mismatch and an SGLang bug.
How could one customer’s prompt appear in another response?
Cloudflare said oversized prompts passed through its split inference setup after being marked for rejection. The decode stage read cache pages that had not been overwritten and still contained data from other requests.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the affected traffic as consistent with ordinary long-context use. The available report does not establish that exploitation was impossible.
What did the Firedancer audit contest show about AI-generated reports?
The contest drew 809 reports from 162 researchers, which Jump Crypto said reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all the reports; the source does not provide an independently verified AI-generated share.
How is Jump responding to the report volume?
Jump’s new bounty platform requires researchers to spend 1 SOL per report, valued at about $100 by CoinDesk in the source material. The effect of that fee on report quality and researcher participation is not yet clear.
Source: ThorstenMeyerAI.com
