🔍 Read the full analysis: Could A Cloudflare Cache Error Send Your AI Answer Elsewhere? on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company traced the issue to a configuration mismatch combined with a bug in the SGLang inference engine; it says it took the model offline and restored a fixed version on Sept. 9. The report says no evidence of deliberate exploitation was found, but does not explain how affected customers were notified.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company attributed the exposure to a mismatch in its memory configuration and a bug in the open-source SGLang inference engine; it said the issue affected only prompts longer than 681,280 tokens and that it found no evidence of deliberate exploitation.
Cloudflare’s incident report, published Oct. 26, says a security researcher reported the behavior through the company’s HackerOne program on Sept. 8. Cloudflare began verification the following morning, declared an incident at 13:22 UTC and took the model offline 38 minutes later. It says a fixed version was restored that evening. The report counts 155 affected responses over the 14-day exposure window, excluding Cloudflare’s own tests and the researcher’s activity.
The issue required two conditions. Cloudflare advertised a 1,048,576-token context window, while the prefill GPUs’ memory pool could hold only 681,280 tokens. A separate SGLang bug allowed requests rejected for exceeding available capacity to continue through a split prefill-and-decode setup. According to Cloudflare, the decode stage could then read cache pages that had not been overwritten and still held other users’ prompts or partial outputs.
Cloudflare said the affected requests were consistent in timing and volume with ordinary long-context use, rather than repeated attempts to exploit the flaw. It also acknowledged that its pre-launch checks at long context lengths validated HTTP responses and engine performance but did not validate generated output and coherence. Cloudflare says it had expected oversized requests to produce errors and had observed successful responses during testing.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident illustrates a privacy risk in shared AI infrastructure: a model response can expose another customer’s input if software handling GPU memory does not correctly isolate requests. The model itself was not identified as the source of the fault; Cloudflare attributed the problem to its deployment configuration and the inference engine’s request handling.
For customers using hosted models with very long context windows, the disclosure makes operational safeguards as relevant as model behavior. Cloudflare’s account also points to a gap in its validation process: a successful HTTP response and acceptable performance did not establish that the output belonged only to the current request. The report does not state how many distinct customers were affected or what the exposed text contained, limiting what can be concluded about individual impact.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Samsung 32-Inch Odyssey OLED G8 (G80SH) 4K Gaming Monitor
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Cache and Configuration Mismatch
Language models store intermediate calculations for prompt tokens in a key-value (KV) cache, which helps generate responses without repeatedly processing the entire prompt. In Cloudflare’s description, cache pages are reused between requests and are not cleared first; the next request is expected to overwrite them. That practice can support performance, but it makes correct allocation and tracking of those pages important for keeping requests separate.
Cloudflare ran the model across separate GPU pools: one built the prompt’s cache and another generated the response. Its report says the pools handled rejected requests differently in a way that let a request too large for the first pool proceed to the second. The report also says the relevant SGLang issue had been filed on July 6, 2026, as issue #30233, and that Cloudflare noticed it during its investigation. Cloudflare’s account says the model’s advertised context limit exceeded the capacity of the prefill memory pool.
“The requests are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”
— Cloudflare incident report
Customer Impact Still Undetailed
Cloudflare’s report gives a count of 155 affected responses, but does not specify the number of customers involved, the content or sensitivity of the exposed text, or how those customers were notified. The available material also does not establish whether any individual response was accessed or retained by someone other than its recipient.
The company says it found no evidence of deliberate exploitation, but that is an account of its investigation rather than proof that misuse was impossible. The report’s description of ordinary-looking timing and volume does not identify the customers whose requests were involved. The extent of any downstream exposure therefore remains unclear from the disclosed information.
Disclosure and Safeguard Questions
Cloudflare says it restored a fixed version of the model on Sept. 9, the same day it took the service offline. The incident report’s release provides a public account of the cause and response, but the material available does not set out further remediation milestones or a schedule for additional updates.
Questions for any follow-up include how Cloudflare checked other deployments for the same failure mode, whether customers received direct notice, and what changes were made to test output isolation at long context lengths. The report also leaves open how SGLang’s handling of rejected requests was addressed beyond the fix Cloudflare deployed. No further findings or customer-notification details are provided in the source material.
Key Questions
What happened to Cloudflare’s hosted AI model?
Cloudflare says its Workers AI GLM-5.3 endpoint returned 155 responses containing text from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company attributed the issue to a memory-capacity mismatch and a bug in SGLang.
Which requests could trigger the issue?
According to Cloudflare, only prompts longer than 681,280 tokens could trigger the bug. The endpoint advertised a context window of 1,048,576 tokens, larger than the capacity of the prefill GPU memory pool.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and that affected requests appeared consistent with ordinary long-context use. That is the company’s assessment of its investigation.
What did Cloudflare do after the report?
After a researcher reported the issue through HackerOne on Sept. 8, Cloudflare says it verified the behavior, declared an incident the next day, took the model offline 38 minutes later and restored a fixed version that evening.
What remains unknown about the impact?
The report does not state how many customers were affected, what the exposed text contained, or how customers were notified. It also does not identify any confirmed downstream access or misuse.
Source: ThorstenMeyerAI.com
