🔍 Read the full analysis: How Cloudflare’s KV Cache Leak Exposed An AI Answer In A Stranger’s Session on ThorstenMeyerAI.com
Get movie nights delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s incident report says its hosted GLM-5.3 model returned data from other customers’ requests in 155 responses between Aug. 27 and Sept. 9, 2026. The issue required prompts longer than 681,280 tokens and resulted from a Cloudflare configuration mismatch combined with a bug in the SGLang inference engine. Cloudflare says it took the model offline, deployed a fix and found no evidence of deliberate exploitation; its report does not explain how affected customers were notified.
Cloudflare says 155 responses from its hosted GLM-5.3 model included data from other customers’ requests during a two-week period in August and September. The company’s Oct. 26 incident report attributes the exposure to a mismatch in its memory configuration and a bug in the open-source SGLang inference engine; only prompts exceeding 681,280 tokens could trigger the problem.
Cloudflare’s report places the affected period between Aug. 27 and Sept. 9, 2026. Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on Sept. 8, saying that very long prompts sent to the @cf/zai-org/glm-5.3 endpoint sometimes produced text from other users’ sessions. Cloudflare counted 155 affected responses, excluding its own tests and Evron’s research activity.
The incident involved two faults. Cloudflare advertised a 1,048,576-token context window, while the memory pool used to hold prompt data could accommodate only 681,280 tokens. Separately, SGLang mishandled prompts that exceeded the available capacity in Cloudflare’s split processing setup. The result was that parts of the memory reserved for a request could contain information left from earlier users’ requests.
Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It reported no evidence of deliberate exploitation. The report says requests associated with the exposure were consistent in timing and volume with ordinary long-context use, rather than repeated attempts to exploit the flaw.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a service can expose customer data through the inference system around a model, even when the model itself is not identified as faulty. Cloudflare’s report points to infrastructure configuration and request-handling logic: when memory pages are reused without being cleared, correct bookkeeping must prevent one request from reading another request’s data.
For customers, the central issue is that a response could contain content they did not provide, without an obvious error message. Cloudflare says affected responses returned successfully, and the incident report describes only a limited trigger involving exceptionally long prompts. That narrows the known conditions, but does not remove the need for customers using hosted AI to understand what data may have been exposed and how the provider handles notification.
The case also highlights the importance of checking generated output and isolation boundaries, not only whether a service returns an HTTP success code or meets performance targets. Cloudflare acknowledged that its long-context tests checked response codes and engine performance without validating the output’s content and coherence.
Popular right now
Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black
Dyson Ball Animal 3 Extra Upright Vacuum
Ninja Flip Toaster Oven and Air Fryer, 8-in-1, Stainless Steel, SP151
As an affiliate, we earn on qualifying purchases.
The Configuration and SGLang Failure
When a language model processes a prompt, it stores intermediate information known as a key-value (KV) cache so it can generate later tokens without repeatedly processing the entire input. The cache uses GPU memory, which inference systems divide into pages that requests borrow and return. Cloudflare says those pages were not cleared between requests because the next request was expected to overwrite them.
Cloudflare ran the model using separate GPU pools: one built the cache from the prompt, and another used that cache to generate the response. According to the report, an oversized prompt was marked rejected and replaced with a one-token placeholder. In the split setup, the queues checked whether the request had finished but not whether it had been rejected. The generation pool had reserved pages for the full prompt; the first pool wrote only the placeholder, leaving other pages with previous users’ data.
Cloudflare says it expected oversized requests to return an error and had seen successful responses in long-context testing. The report says those tests did not verify model output. It also says the relevant SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but Cloudflare noticed it only during its investigation. The affected model is GLM-5.3, a text-generation model from Z.ai; the report does not attribute the flaw to the model itself.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare’s incident report
Customer Notifications Remain Unspecified
Cloudflare’s published report does not say how affected customers were notified, whether all customers whose data appeared in the 155 responses have been identified, or what kinds of prompt content were involved. The figure refers to affected responses, not necessarily a count of individual customers or distinct data items.
The report says Cloudflare found no evidence of deliberate exploitation and describes the traffic as consistent with normal long-context use. That is the company’s assessment; the available source material does not provide an independent review of the incident or details about the full contents of the exposed responses. It is also not clear whether other models or configurations shared the same conditions.
What Cloudflare Must Clarify
Cloudflare says it restored a fixed version of the model on the evening it responded to the incident. The next questions for customers are whether they were directly informed, what data the company determined was present in affected outputs, and what changes it has made to test memory isolation and rejected requests across its inference systems.
The incident report provides the company’s account of the cause, response and scope, but does not describe any further review or customer-facing steps. Until Cloudflare supplies those details, the extent of individual customer impact and whether the same failure could affect other deployments remain open questions.
Key Questions
What data did the Cloudflare AI incident expose?
Cloudflare says 155 GLM-5.3 responses contained data from other customers’ requests. Its report does not specify the contents of those prompts or identify the customers affected.
What caused the cross-session leak?
The report attributes it to a memory-capacity mismatch and a bug in SGLang’s handling of rejected requests in Cloudflare’s split processing setup. Some memory pages could retain other users’ prompt data.
Could ordinary prompts trigger the problem?
Cloudflare says the issue could be triggered only by prompts longer than 681,280 tokens. It characterized the affected request pattern as consistent with ordinary long-context use, not repeated exploitation.
Has Cloudflare fixed the issue?
Cloudflare says it took the model offline after declaring an incident and restored a fixed version that evening. The report does not say how affected customers were notified or detail any broader review of other model deployments.
Source: ThorstenMeyerAI.com
