🔍 Read the full analysis: Inside The Cloudflare Bug: AI Answers In Stranger Sessions on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. A configuration mismatch and a bug in the SGLang inference engine allowed oversized prompts to reach decoding with stale GPU memory. Cloudflare says it took the model offline, deployed a fix and found no evidence of deliberate exploitation.
Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a 14-day period. The company attributed the leak to a mismatch between the model’s advertised context window and available GPU memory, combined with a bug in the open-source SGLang inference engine; it said it found no evidence of deliberate exploitation.
Cloudflare’s report says the affected endpoint was @cf/zai-org/glm-5.3, and that only prompts longer than 681,280 tokens could trigger the issue. The model was configured to accept a context window of 1,048,576 tokens, but the memory pool used to hold the prompt’s intermediate data was smaller. Cloudflare said the requests associated with the 155 responses appeared consistent in timing and volume with ordinary long-context use, after excluding its own tests and the researcher’s.
The company described two faults that combined. Its configuration allowed prompts beyond the memory pool’s capacity, while SGLang mishandled requests that could not fit: in Cloudflare’s split prefill-and-decode setup, queues checked whether a request had finished but not whether it had been rejected. The decoder then read reserved memory pages that prefill had not overwritten. Cloudflare said those pages still contained other users’ prompts and partial generations. Affected clients received HTTP 200 responses rather than an error.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8, according to the report. Cloudflare began verification the following morning, declared an incident at 13:22 UTC and took the model offline 38 minutes after that declaration. It restored a fixed version later that evening. The report says Cloudflare found the underlying SGLang issue, filed as issue #30233 on July 6, during its investigation.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why Cross-Session Memory Matters
The incident shows that an AI service can expose customer information through inference infrastructure, even when the model itself is not the source of the flaw. Cloudflare said the GLM model was not at fault: the problem arose in how the service allocated and transferred memory between requests. For customers sending code, documents or other private material to a hosted model, that distinction does not reduce the potential impact. Their data may still appear in another customer’s answer.
The report also highlights a tension between performance and isolation. Cloudflare said KV-cache pages are not zeroed between requests because the next request is expected to overwrite them, a practice it described as common and useful for performance. In this case, that safeguard depended on correct request handling. When an oversized request was rejected in one part of the system but treated as active in another, old page contents remained accessible to a later decoding step.
Cloudflare’s finding of 155 affected responses gives the incident a defined scope, but it does not establish how many customers were involved or what kinds of information appeared in the responses. The event matters to operators of hosted AI services because it points to the need to test returned content and data isolation—not just successful HTTP status codes and performance—at extreme context lengths.
Popular right now
KitchenAid Artisan 5-Quart Tilt-Head Stand Mixer, Almond Cream
Dyson Ball Animal Total Clean Upright Vacuum
Dyson Ball Animal 2 Plus Corded Vacuum
As an affiliate, we earn on qualifying purchases.
How the Memory Mismatch Worked
When a language model processes a prompt, it stores intermediate calculations in a key-value cache, or KV cache, so it can generate each next token without processing the full prompt again. These caches occupy GPU memory. In Cloudflare’s system, one GPU pool processed prompts and built the cache; another pool used it to generate answers. The service allocated cache space in pages that could be reused between requests.
Cloudflare said it expected prompts that exceeded available memory to produce an error. Instead, the SGLang bug replaced a rejected request with a one-token placeholder in the prefill stage, while the decode stage retained space reserved for the original, much longer prompt. It could then read pages that had not been written for that request. Cloudflare said the only apparent signal in the affected responses was that they arrived faster than expected; they still returned a successful status and could appear coherent.
According to the report, Cloudflare had known about the difference between the 1,048,576-token advertised window and the 681,280-token memory capacity before launch. It expected the engine to reject prompts that did not fit. The company said its long-context tests checked HTTP response codes and engine performance, but did not check model output and coherence. That testing gap allowed the configuration and engine behavior to go undetected before deployment.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare, in its incident report
What the Report Does Not Specify
Cloudflare’s public report does not say how many customers were affected, what categories of customer data appeared in the responses, or whether any recipient recognized or reported another user’s material. The figure of 155 refers to affected responses, not necessarily 155 customers or 155 separate data records. The report also does not explain how affected customers were notified.
Cloudflare said it found no evidence of deliberate exploitation and that the request pattern looked like ordinary long-context use. That is the company’s assessment of the evidence it reviewed; the published account does not provide customer-level details or a full description of what data each response contained. It is also not clear from the supplied report whether the SGLang issue has since been fixed upstream or how its maintainers responded.
Fixes and Customer Notifications
Cloudflare says it took the model offline after declaring the incident and restored a fixed version that evening. Its report describes the repair but the available material does not detail the safeguards now in place, such as how oversized prompts are handled across both GPU pools or whether additional output checks have been added.
The next information readers need is whether Cloudflare has notified affected customers and what data, if any, was exposed in each response. Further clarification from Cloudflare or the SGLang project could also establish whether the software issue has been addressed for other operators using the same inference engine. Until those details are public, the incident’s customer-level impact remains unresolved.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says its hosted GLM-5.3 endpoint returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The issue required prompts longer than 681,280 tokens and resulted from a configuration mismatch combined with an SGLang bug.
Was the GLM-5.3 model itself responsible?
Cloudflare attributed the issue to its serving configuration and inference engine, not to the GLM model. The failure involved memory allocation and request handling between the prefill and decode stages.
Did Cloudflare find evidence of an attack?
No. Cloudflare said the affected requests appeared consistent with ordinary long-context use, rather than repeated deliberate exploitation. That is the company’s assessment in its incident report.
How did Cloudflare respond?
After a researcher reported the issue on September 8, Cloudflare investigated, declared an incident the next day, took the model offline 38 minutes after the declaration and restored a fixed version later that evening.
How many customers were affected, and were they notified?
The report counts 155 affected responses but does not say how many customers those responses involved. It also does not state how affected customers were notified or specify what types of information appeared in the responses.
Source: ThorstenMeyerAI.com
