🔍 Read the full analysis: AI Spam Is Making Bug Hunting Harder—Here’s The Cloudflare Connection on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. Separately, Jump Crypto says an audit contest produced 809 submissions but only 127 unique findings, illustrating how AI-generated reports can strain security review. The cases show distinct security problems: a model-serving failure and a growing challenge in sorting vulnerability reports.
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses over a two-week period in August and September, after a configuration mismatch combined with a bug in the open-source SGLang inference engine. The disclosure, published October 26, coincides with a separate signal of pressure on vulnerability review: Jump Crypto says an audit contest received 809 submissions that amounted to 127 unique findings, most of them believed by the company to have involved AI agents.
Cloudflare’s report says the model leak affected requests made between August 27 and September 9. The company traced the issue to prompts exceeding 681,280 tokens, even though the service advertised a context window of 1,048,576 tokens. A researcher, Gadi Evron of Knostic, reported the behavior through Cloudflare’s HackerOne program on September 8. Cloudflare says it found 155 affected responses, excluding its own testing and the researcher’s requests.
The incident involved two faults, according to Cloudflare. Its prefill GPU pool had less memory available for the model’s key-value cache than the advertised context length implied. SGLang, the inference engine, then allowed a rejected request to pass through parts of a split processing system. In some cases, the system read cache pages that had not been overwritten, returning text associated with other requests. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that day.
A different security workload appears in Jump Crypto’s Firedancer audit contest. The contest offered $1 million in potential rewards and drew 809 reports from 162 researchers; Jump says these corresponded to 127 unique findings. The company believes AI agents found or wrote nearly all the submissions. Its new bounty platform requires researchers to stake 1 SOL per report, about $100 according to CoinDesk. That contest is separate from Cloudflare’s incident and does not establish that AI-generated reports caused the leak.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
When Bug Reports Outnumber Findings
The two developments point to different pressures in AI security. Cloudflare’s case shows how a failure in infrastructure around a hosted model can expose material from other customers’ requests, even when the model itself is not identified as the source of the bug. That makes testing service configuration and the inference stack as important as evaluating model behavior.
Jump’s contest illustrates a review problem: generating a plausible report can be cheaper and faster than verifying whether it describes a distinct, actionable vulnerability. If security teams spend more time deduplicating low-value submissions, valid findings may take longer to assess. Jump’s stake is one response, but the contest figures alone do not show whether the measure will improve report quality across other programs.
For customers and researchers, the distinction matters. A reported vulnerability is not automatically a confirmed exploit, and an AI-assisted submission is not automatically false. The practical challenge is to investigate credible reports quickly while protecting users and keeping review processes workable.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Bose SoundLink Flex Bluetooth Speaker (2nd Gen), Portable Waterproof Speaker, Black
Amazon Kindle Paperwhite (12th Generation, 2024), 16 GB, 7-inch Display, Jade
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Occurred
Language models use a key-value cache to retain intermediate calculations from earlier tokens, reducing the work needed to generate each next token. In Cloudflare’s description, cache pages were reused between requests without being cleared first; the next request was expected to overwrite them. That approach can support performance, but it depends on the system correctly tracking which pages belong to each request.
Cloudflare said its service split prompt processing and answer generation across separate GPU pools. Its configuration advertised a million-token context window, while the relevant prefill cache could hold 681,280 tokens. The company expected requests that exceeded capacity to return an error. Instead, Cloudflare says, SGLang replaced an oversized rejected request with a one-token placeholder, while queues in the split setup checked whether a request had finished but not whether it had been rejected. The answer-generation stage could then read reserved pages that still contained earlier request data.
Cloudflare acknowledged that its pre-launch long-context checks focused on HTTP status codes and engine performance, without validating the model’s output and coherence. It also said the SGLang issue had been reported publicly in issue #30233 on July 6, 2026, but the company noticed it only during its investigation. Separately, security-report volume has been a concern for bug bounty programs: the source account says curl ended its bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions that month. Those figures describe different programs and policies, not a single measured rate of AI-generated reports.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
Questions on Exposure and Report Quality
Cloudflare’s public report, as described in the source material, does not explain how affected customers were notified or specify what data types appeared in the leaked text. It says 155 responses contained other customers’ request data, but the source does not provide a breakdown of affected accounts or the volume of information in each response. Cloudflare says it found no evidence of deliberate exploitation; that is the company’s finding, not proof that misuse was impossible.
It is also not clear from the provided account whether any customers reported downstream harm, or what independent review has been conducted. For Jump’s contest, the figures do not identify how many reports were generated by AI, how the company decided reports involved AI agents, or how many findings were ultimately validated and rewarded. The two cases should not be treated as evidence of a direct connection between the Cloudflare leak and the contest submissions.
Follow-Up From Cloudflare and Auditors
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it declared the incident, after taking the model offline. Further public detail about customer notification, the scope of exposed text, and any follow-up review would help clarify the impact. The company’s report also points to a need for output-level testing of long-context requests, rather than relying only on successful HTTP responses and performance checks.
Jump’s new platform will apply its 1 SOL submission stake as a way to discourage low-quality or duplicate reports. Its results over future contests will show whether that approach changes submission volume or review efficiency. Across both developments, the next useful evidence will be specific: verified exposure details from Cloudflare and transparent reporting on how bounty programs distinguish unique, actionable findings from repeated or AI-assisted submissions.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare says 155 responses from its hosted model contained text from other customers’ requests between August 27 and September 9, 2026. The company attributes the issue to a cache-capacity mismatch and a bug in the SGLang inference engine.
Was the GLM-5.3 model itself responsible?
Cloudflare’s account points to its service configuration and the inference engine, not a fault in the GLM model itself. The leak occurred in how the service handled cache pages for oversized requests.
Did Cloudflare find evidence that someone deliberately exploited the bug?
No evidence of deliberate exploitation was reported by Cloudflare. The company said the affected requests were consistent in timing and volume with ordinary long-context use.
Why did Jump Crypto receive so many audit reports?
Jump’s $1 million Firedancer contest received 809 reports from 162 researchers, which the company said boiled down to 127 unique findings. Jump believes AI agents found or wrote nearly all of them, but the source does not provide an independently verified AI-generated count.
How is Jump trying to limit low-quality submissions?
Jump’s new bounty platform requires researchers to stake 1 SOL per report, valued at about $100 in the cited CoinDesk account. Whether the fee reduces duplicates or affects valid submissions remains to be seen.
Source: ThorstenMeyerAI.com
