🔍 Read the full analysis: The Cloudflare KV Cache Leak That Put AI Session Isolation Under Scrutiny on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company traced the issue to a context-window configuration mismatch and an SGLang bug, took the model offline and restored a fixed version; notification details and the full scope of affected customers were not specified in the source report.
Cloudflare says 155 responses from its hosted GLM-5.3 model contained text from other customers’ requests during a two-week period in 2026. In an incident report published October 26, the company attributed the exposure to a mismatch between its advertised context window and available cache memory, combined with a bug in the open-source inference engine SGLang.
Cloudflare’s report says the affected responses were generated between August 27 and September 9, and involved prompts longer than 681,280 tokens. The company said it counted 155 affected responses after excluding its own testing and the researcher’s requests. It characterized the remaining request timing and volume as consistent with ordinary long-context use, rather than repeated deliberate exploitation. That is Cloudflare’s assessment; the report does not establish who received each response or what information each contained.
Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8. Cloudflare began verification the following morning, declared an incident at 13:22 UTC, and took the model offline 38 minutes after that declaration, according to the source account. It restored a fixed version later that evening. Cloudflare said it found no evidence of deliberate exploitation.
The technical failure involved two conditions. Cloudflare advertised a 1,048,576-token context window, while the prefill GPU memory pool used for the model’s key-value cache could hold 681,280 tokens. A SGLang bug then allowed a rejected oversized request to pass through parts of a split prefill-and-decode serving system. The decode stage could read cache pages that had not been overwritten for that request, producing a successful-looking response that included residual data from other requests.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident puts attention on tenant isolation in hosted AI services: users send prompts to infrastructure shared across customers, and the provider’s software and configuration must keep each request’s data separate. Cloudflare says the exposed material came from other customers’ requests, making this a confidentiality issue even though the trigger required an unusually long prompt.
The case also illustrates why a successful HTTP response is not proof that a model handled a request safely or correctly. Cloudflare said its pre-launch long-context testing checked HTTP response codes and engine performance but did not validate the generated output’s coherence. The response could appear usable while containing unrelated text. For customers using hosted models with long prompts, the disclosure raises practical questions about what data was returned, whether it was retained elsewhere, and how quickly affected users were informed.
Cloudflare’s report appeared alongside a separate concern about AI-generated security reports overwhelming review systems. The source describes Jump Crypto’s Firedancer audit contest receiving 809 submissions from 162 researchers, which Jump said reduced to 127 unique findings, and a new 1 SOL fee per report on its bounty platform. That is a distinct issue, not part of the Cloudflare incident, but both accounts point to the growing need for effective human and technical review as AI use expands.
Products Worth Considering
Amazon Kindle Paperwhite Signature Edition (12th Generation, 2024), 32 GB, Metallic Black
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Sony WH-1000XM6 Wireless Noise-Canceling Over-Ear Headphones, Blue, Bundle
As an affiliate, we earn on qualifying purchases.
How the Cache Failure Developed
A key-value (KV) cache stores intermediate model calculations so a language model can generate text without repeatedly processing an entire prompt. In Cloudflare’s described setup, cache pages were allocated from a shared GPU memory pool. The company said pages were not zeroed between requests; a later request was expected to overwrite the pages it received, a common performance practice. Isolation therefore depended on the serving system allocating and tracking those pages correctly.
Cloudflare ran the model in a disaggregated setup: one GPU group processed prompts and built the cache, while another generated responses from it. When an oversized prompt did not fit, SGLang marked it rejected and substituted a one-token placeholder. Cloudflare said the queues in the two stages checked whether a request was finished but did not check whether it had been rejected. The decode stage had reserved pages for the original prompt, while prefill wrote only the placeholder. It could then read pages still holding other requests’ text.
Cloudflare said it had known before launch that the configured context window exceeded the pool’s capacity, but expected the inference engine to return an error for prompts that would not fit. The company also said a related SGLang issue had been filed on July 6, 2026, and that it noticed the report only during its investigation. The model itself was not identified as the source of the bug; the reported failure was in configuration and inference serving.
What Cloudflare Has Not Disclosed
The source account does not say how many customers were affected, which customers received the exposed material, or what kinds of prompt content appeared in the 155 responses. It also does not describe how Cloudflare notified affected customers, whether any data was copied or retained beyond the responses, or whether independent investigators reviewed the company’s scope assessment.
Cloudflare reported no evidence of deliberate exploitation, but that statement is not the same as confirming that no unauthorized person saw the responses. The report also does not provide a full account of the repair or say whether the same configuration and queue checks were reviewed across other models and serving configurations. Those details remain unclear from the supplied material.
Customer Notices and Safeguards
The next developments to watch are any further details from Cloudflare about customer notifications, affected data and remediation, as well as changes to its long-context validation and request-rejection checks. The company has said it restored a fixed model version the evening of the incident, but the supplied report does not set out a schedule for additional public updates or independent verification.
For now, Cloudflare’s incident report provides the confirmed timeline and technical explanation available in the source material. Whether more information will be released about the affected customers or the broader review of related deployments remains unknown.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare said 155 GLM-5.3 responses included text from other customers’ requests between August 27 and September 9, 2026. The company attributed the problem to a cache-capacity configuration mismatch and a bug in SGLang.
Which requests could trigger the issue?
According to Cloudflare’s report, the affected responses involved prompts longer than 681,280 tokens. The reported context-window setting was 1,048,576 tokens, larger than the relevant prefill cache pool.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and that the observed request timing and volume were consistent with ordinary long-context use. That is the company’s assessment of the activity it reviewed.
What has Cloudflare said about affected customers?
The supplied source does not identify the affected customers or explain how they were notified. It also does not provide details about the content of each exposed response.
Has Cloudflare fixed the issue?
Cloudflare took the model offline after declaring an incident and said it restored a fixed version that evening. The source does not give further details about independent review or safeguards across other deployments.
Source: ThorstenMeyerAI.com
