🔍 Read the full analysis: The Stranger Session Problem Behind Cloudflare’s AI Cache Leak on ThorstenMeyerAI.com
Get the little things that make your day delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The company attributed the leak to a context-window configuration mismatch combined with a bug in SGLang, and says it found no evidence of deliberate exploitation. Its report does not explain how affected customers were notified.
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests during a 14-day period in August and September 2026. In an incident report published October 26, the company attributed the leak to a mismatch in its memory configuration combined with a bug in the open-source SGLang inference engine; it said it found no evidence of deliberate exploitation.
The issue affected requests to Cloudflare’s Workers AI endpoint for GLM-5.3, a text-generation model made by Z.ai. Cloudflare’s report says every affected response followed a prompt longer than 681,280 tokens. Security researcher Gadi Evron reported the behavior through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes returned text from other users’ sessions.
Cloudflare traced the problem to two faults that interacted. Its configuration advertised a 1,048,576-token context window, while the prefill GPUs’ memory pool could hold only 681,280 tokens. Separately, SGLang mishandled prompts that exceeded available capacity in Cloudflare’s distributed setup: the request was marked rejected and replaced with a one-token placeholder, but the system’s queues checked whether it had finished, not whether it had been rejected.
As a result, the decode stage could read cache pages that the failed request had not overwritten. Cloudflare says those pages still contained other users’ prompts and partial generations. The response could arrive with HTTP 200 and appear coherent, rather than producing an error. Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening, according to the source report.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how inference-engine bookkeeping and deployment configuration can become privacy controls when a service reuses GPU memory between requests. Cloudflare says its cache pages are not cleared between requests; instead, the next request is expected to overwrite them. That approach can support performance, but it depends on each stage of the system handling rejected or oversized requests correctly.
For customers, the concern is not that the model was shown to have intentionally disclosed information, but that one customer’s response could include another customer’s text. The report does not identify the affected users or describe what the leaked content contained. It also does not establish that every response exposed sensitive information. The reported total is 155 affected responses, not a count of customers or a measure of the amount of data exposed.
The same source report describes a separate pressure point in security work: AI-generated vulnerability submissions can increase the time required to assess reports. It says Jump Crypto’s Firedancer audit contest received 809 submissions from 162 researchers, which were consolidated into 127 unique findings, and that Jump believed AI agents found or wrote nearly every submission. That example is not part of Cloudflare’s incident, but it illustrates a broader operational challenge: AI can raise both the volume of system use and the volume of security reports, while human review remains necessary.
Products Worth Considering
BowFlex Results Series SelectTech 552 Adjustable Dumbbell
Garmin Forerunner 55 GPS Running Smartwatch, Black
Garmin Forerunner 70 GPS Running Smartwatch, 43 mm, Black
As an affiliate, we earn on qualifying purchases.
The Configuration Behind the Leak
Cloudflare ran the model in a disaggregated setup: one group of GPUs processed prompts and built the key-value cache, while another group generated responses using that cache. The cache stores intermediate values from a prompt so a model does not need to recompute them for every generated token. In this deployment, the cache was divided into fixed-size pages drawn from a shared memory pool.
Cloudflare said it knew about the mismatch between the advertised context window and the smaller memory pool before launch. It expected the inference engine to return an error for prompts that exceeded capacity. In the report, the company acknowledged that its long-context tests checked HTTP response codes and engine performance but did not validate the model’s output and coherence. Cloudflare also said it discovered during its investigation that the relevant SGLang behavior had been reported in issue #30233 on July 6, 2026.
According to the report, Evron submitted the finding at 23:11 UTC on September 8. Verification began at 08:00 the next morning, and Cloudflare declared an incident at 13:22. The company says it reproduced the leak, took the model offline 38 minutes after the incident declaration and restored a fixed version that evening.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare’s incident report
Customer Notifications and Exposure Scope
Cloudflare says it found 155 affected responses and that, after excluding its own tests and the researcher’s, the requests were consistent in timing and volume with ordinary long-context use rather than repeated exploitation. The company reported no evidence of deliberate exploitation. These findings describe what Cloudflare says it observed; they do not establish who received every response or what information each contained.
The incident report, as summarized in the source material, does not say how or when affected customers were notified, whether any customer data was independently confirmed as sensitive, or whether customers took steps in response. It also does not provide a separate count of affected accounts. The precise contents and downstream use of the cross-session text remain unclear.
Fixes, Review and Customer Follow-Up
Cloudflare says it restored a fixed version of the model on the evening of September 9 after taking the affected service offline. The source material does not provide a later status update on further remediation, such as changes to memory clearing, request validation or long-context testing. It also does not state whether Cloudflare or SGLang published additional fixes beyond the version Cloudflare restored.
The immediate questions for customers are whether they were among those affected and whether Cloudflare has provided them with case-specific details. The published account leaves customer notification and the scope of the exposed text unanswered. Further reporting should distinguish Cloudflare’s incident findings from any independent review and establish whether the company has described additional safeguards or follow-up with affected users.
Key Questions
What happened in the Cloudflare AI cache leak?
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. The company attributed the issue to a memory-capacity mismatch and a bug in SGLang.
Which requests could trigger the problem?
According to Cloudflare, every affected response followed a prompt longer than 681,280 tokens, the capacity of the relevant prefill memory pool.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and described the timing and volume of requests, after excluding its own tests and the researcher’s, as consistent with ordinary long-context use.
How did the technical failure expose other users’ text?
A rejected oversized request was treated as though it had completed in part of the distributed inference system. The decode stage then read cache pages the request had not overwritten, which Cloudflare says still held other users’ prompts and partial generations.
How were affected customers notified?
The incident report described in the source material does not say how affected customers were told. It also does not provide a count of affected customer accounts or details about the contents of each response.
Source: ThorstenMeyerAI.com
