🔍 Read the full analysis: The Cloudflare KV Cache Leak Behind A Stranger’s AI Answer on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributes the exposure to a mismatch in its KV cache configuration combined with a bug in the SGLang inference engine; it says it found no evidence of deliberate exploitation.
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, according to an incident report published October 26. The company attributed the leak to a KV cache capacity mismatch combined with a bug in the open-source SGLang inference engine, and said it found no evidence that anyone deliberately exploited the issue.
The issue affected requests sent to Cloudflare’s Workers AI endpoint for @cf/zai-org/glm-5.3. Cloudflare’s report says every affected response involved a prompt longer than 681,280 tokens. The model itself, developed by Z.ai, was not identified as the source of the flaw; the failure arose in the infrastructure handling long prompts and their cached data.
Cloudflare had configured a context window of 1,048,576 tokens, while the memory pool used to hold the prompt’s KV cache could accommodate only 681,280. When a request exceeded the available capacity, SGLang marked it as rejected and substituted a one-token placeholder. In Cloudflare’s split prefill-and-decode system, queues checked whether requests had finished but not whether they had been rejected. The decode stage could then read cache pages that had not been overwritten and still contained other users’ prompts or partial responses.
A researcher reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare’s timeline says the report arrived at 23:11 UTC; the company began verification the next morning, declared an incident at 13:22, and took the model offline 38 minutes later. It restored a fixed version that evening. Cloudflare said it excluded its own tests and the researcher’s activity when reviewing the 155 responses.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Long Prompts Crossed Customer Boundaries
The incident shows how a failure in the systems around an AI model can expose information even when the model itself is not the cause. Shared GPU memory and cache management are performance components, but they also separate one customer’s request from another’s. Here, an error-handling gap allowed a rejected long prompt to continue through one part of the service and receive cache pages containing data from earlier requests.
For customers using hosted AI services, the report raises practical questions about data isolation, incident notification and testing. Cloudflare says it found no evidence of deliberate exploitation, but the affected responses were returned to clients as successful HTTP 200 responses. That could make the fault difficult for a user to recognize from status codes alone. The company’s account also describes tests that checked response codes and performance at long context lengths without validating the generated output’s coherence or contents.
The report appeared in the same period as wider concern about the effects of AI-generated security reports on vulnerability programs. The supplied account says Jump Crypto’s $1 million Firedancer audit contest received 809 reports from 162 researchers, which it reduced to 127 unique findings; Jump believes AI agents found or wrote nearly all submissions. That is a separate development, not evidence about the Cloudflare incident, but together the cases illustrate two distinct security pressures: AI infrastructure can fail in ways that expose data, while AI-assisted reporting can increase the work required to assess bugs.
Products Worth Considering
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Apple MacBook Air 15-inch Laptop with M5 Chip, 16GB Memory, 512GB SSD, and Liquid Retina Display
Apple MacBook Pro 16.2-inch with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 1TB SSD, Nano-Texture Display, Space Black
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Worked
A KV cache stores intermediate calculations a language model has made while processing a prompt. Reusing those calculations lets the model generate an answer without repeating all of its earlier work. Cloudflare’s report says the cache is held in GPU memory and divided into fixed-size pages that requests borrow and return. The pages are not cleared between requests; the intended protection is that a later request overwrites them before they are read.
Cloudflare ran the model in a disaggregated setup: one group of GPUs processed prompts and built the cache, while another generated responses from it. The configuration mismatch meant a very long request could reserve more cache pages at the decode stage than prefill had actually written. Because the two admission queues failed to stop a request marked rejected, decode could read the leftover pages. Cloudflare says the response could still look coherent and arrive with a matching token count; its report identifies unusually fast completion as a possible clue.
Cloudflare also said the underlying SGLang bug had previously been reported as issue #30233 on July 6, 2026, but that it became aware of the issue during its investigation. The company’s account says it had known of the context-window and cache-capacity mismatch before launch and expected the inference engine to return an error for requests that exceeded capacity.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
Customer Notifications Remain Undisclosed
Cloudflare’s supplied report does not explain how affected customers were notified, whether every customer whose data appeared in a response has been identified, or what kinds of information were present in the exposed text. The available account also does not give a breakdown of the 155 responses by customer or describe whether any customer confirmed receiving another user’s content.
The company says it found no evidence of deliberate exploitation and that the requests matched ordinary long-context use in timing and volume. That is Cloudflare’s finding, not proof that the data was never accessed or retained by recipients. The report material provided here does not detail what evidence Cloudflare examined to reach its conclusion, or whether further investigation is ongoing.
Follow-Up on Fixes and Notice
Cloudflare says it took GLM-5.3 offline after declaring an incident and restored a fixed version later on September 9. The next questions for customers and security observers are whether Cloudflare will publish further details on customer notifications, affected data and validation of the fix, and whether the SGLang issue has been addressed in other deployments using the same inference engine.
The company’s report also points to changes needed in testing: long-context checks should verify generated content and rejection behavior, not only successful HTTP codes and system performance. No further public milestone or follow-up date is specified in the supplied material.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The affected requests were longer than 681,280 tokens.
What caused the data exposure?
Cloudflare attributed it to a mismatch between the advertised context window and available KV cache capacity, combined with a bug in SGLang’s handling of rejected requests in Cloudflare’s split inference setup.
Did Cloudflare say someone exploited the bug deliberately?
No. Cloudflare said it found no evidence of deliberate exploitation and described the affected requests as consistent in timing and volume with ordinary long-context use. That is the company’s assessment.
How did Cloudflare respond?
After a researcher reported the issue on September 8, Cloudflare verified it, declared an incident, took the model offline 38 minutes later, and restored a fixed version that evening, according to its timeline.
What has Cloudflare not disclosed?
The supplied report does not say how affected customers were notified, what specific information appeared in the responses, or whether every affected customer has been identified.
Source: ThorstenMeyerAI.com
