🔍 Read the full analysis: Cloudflare’s KV Cache Leak Put AI Answers In Stranger Sessions on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare reported that its hosted GLM-5.3 model returned data from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company traced the issue to a mismatch in its KV-cache capacity and a bug in the SGLang inference engine; it took the model offline and restored a fixed version. Cloudflare says it found no evidence of deliberate exploitation, but its report does not explain how it notified affected customers.
Cloudflare says a bug in its hosted GLM-5.3 AI service caused 155 responses between August 27 and September 9 to include data from other customers’ requests. The company traced the exposure to a mismatch between the model’s advertised context window and available memory, combined with a bug in the SGLang inference engine; it says it took the model offline and restored a fixed version on the day it confirmed the incident.
Cloudflare’s incident report, published October 26, says only prompts longer than 681,280 tokens could trigger the issue. The service advertised a context window of 1,048,576 tokens, but the memory pool used to store the prompt’s intermediate calculations—the KV cache—could hold less. Cloudflare said it expected requests exceeding that capacity to fail, but its long-context testing checked response codes and engine performance rather than the accuracy or coherence of generated output.
The second fault was in SGLang, the open-source inference engine. According to Cloudflare, an oversized request was marked as rejected and replaced with a one-token placeholder. In the company’s split processing setup, queues checked whether a request had finished but not whether it had been rejected. The decoding stage then read cache pages that had not been written for that request, allowing parts of other users’ prompts and generated text to appear in a response.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare says it declared an incident at 13:22 UTC the following day and took the model offline 38 minutes later. It restored a fixed version that evening. The report says the 155 affected responses occurred across the 14-day period, excluding Cloudflare’s own tests and the researcher’s requests.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in infrastructure around an AI model can expose information even when the model itself is not at fault. Cloudflare’s report attributes the leak to capacity configuration and request handling, not to GLM-5.3 producing an intentional or model-specific disclosure. For businesses using hosted AI with long prompts, the case highlights that protections depend on the service correctly isolating each request’s working memory.
KV caches hold intermediate data generated while a model processes a prompt. Cloudflare says its cache pages are not cleared between requests; they are expected to be overwritten when assigned again. That approach can support performance, but it makes accurate allocation and queue checks important. In this incident, the rejected request’s incomplete cache write left pages containing earlier material available to the decoder.
The potential concern is not limited to a response being wrong or incoherent. A customer could receive text originating in another session, creating a confidentiality risk. Cloudflare says it found no evidence that anyone deliberately exploited the flaw, but the reported responses still represent a cross-customer data exposure. The company’s account does not identify what kinds of information appeared in those responses.
Products Worth Considering
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
As an affiliate, we earn on qualifying purchases.
The Two Faults Behind the Leak
Cloudflare runs GLM-5.3 in a disaggregated setup: one group of GPUs processes the prompt and builds its KV cache, while another group uses that cache to generate the answer. The two stages rely on the request’s cache allocation remaining consistent as data moves between them. Cloudflare says the prefill memory pool had capacity for 681,280 tokens even though the endpoint was configured to accept contexts as long as 1,048,576 tokens.
When a prompt exceeded the pool’s capacity, SGLang’s rejection handling and Cloudflare’s queue checks did not align. The decoder had reserved pages for the full request, but prefill wrote only the placeholder. It then read additional pages that still held other users’ data. Cloudflare says the client received an HTTP 200 response and a token count consistent with the long prompt; the response could appear coherent, while arriving faster than expected.
Cloudflare also said the SGLang issue had been reported upstream as issue #30233 on July 6, 2026, but the company noticed it only during its investigation. It described the GLM-5.3 model itself as not being the cause. Cloudflare’s report says long-context tests had returned successful responses, but those tests did not validate model output and coherence.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notices and Data Scope
Cloudflare’s published account does not say how or when affected customers were notified. It also does not specify what categories of customer information appeared in the 155 responses, how many customers were affected, or whether the same customer’s data appeared in multiple responses. The total is a count of affected responses, not a stated count of individual users or accounts.
The company says the requests were consistent with normal long-context use and that it found no evidence of deliberate exploitation. That is Cloudflare’s finding, not proof that no one attempted to trigger the bug. The report excerpt also does not provide a full account of the fix, independent validation of the remediation, or whether other hosted models or configurations could have been exposed.
Fix Verification and Customer Follow-Up
Cloudflare says it restored a fixed version of GLM-5.3 on the evening it took the service offline. Its report gives the immediate response timeline, but the source material does not identify a further public update date or describe any planned external review. Follow-up details that would clarify the incident include how Cloudflare confirmed the fix, whether it assessed other services using the same inference setup, and how it communicated with affected customers.
The SGLang issue cited by Cloudflare may also inform how the inference engine handles rejected requests in split processing systems. The source material does not say whether that upstream issue has since been fixed. For customers, the clearest next step is to look for Cloudflare’s account of notification, the scope of affected data, and any additional findings about systems using the same cache and queue design.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says 155 GLM-5.3 responses contained data from other customers’ requests between August 27 and September 9, 2026. A cache-capacity mismatch and an SGLang request-handling bug allowed the decoder to read cache pages that had not been written for the current request.
Which prompts could trigger the issue?
Cloudflare says the issue affected prompts longer than 681,280 tokens. The endpoint advertised a maximum context window of 1,048,576 tokens, exceeding the capacity of the relevant prefill memory pool.
Was the GLM-5.3 model itself responsible?
Cloudflare attributed the problem to its service configuration and a bug in the SGLang inference engine. The company said the model itself did not cause the issue.
Did Cloudflare find evidence of an attack?
Cloudflare said it found no evidence of deliberate exploitation. Its report described the timing and volume of the affected requests as consistent with ordinary long-context use, while not claiming that exploitation was impossible.
Were affected customers notified?
The incident report described in the source material does not say how or when customers were notified. It also does not specify the types of data exposed or the number of distinct customers affected.
Source: ThorstenMeyerAI.com
