🔍 Read the full analysis: Why Cloudflare’s KV Cache Bug Made AI Session Privacy A Concern on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says a configuration mismatch and an SGLang bug caused its hosted GLM-5.3 model to return text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The issue affected prompts longer than 681,280 tokens; Cloudflare says it took the model offline, restored a fix, and found no evidence of deliberate exploitation.
Cloudflare said a bug in its hosted GLM-5.3 service caused 155 responses to include text from other customers’ requests between August 27 and September 9, 2026. The company’s October 26 incident report says the exposure required prompts longer than 681,280 tokens and resulted from a configuration mismatch combined with a bug in the open-source SGLang inference engine.
Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes returned text belonging to other users’ sessions. Cloudflare’s investigation counted 155 affected responses during the 14-day period. It said that, after excluding its own tests and the researcher’s activity, the requests were consistent in timing and volume with ordinary long-context use, rather than repeated attempts to exploit the flaw.
The technical conditions involved two failures. Cloudflare configured a 1,048,576-token context window, but the memory pool available for the model’s key-value cache held only 681,280 tokens. Separately, SGLang did not correctly stop an oversized request in Cloudflare’s split prefill-and-decode setup. The prefill stage wrote a one-token placeholder after rejecting the request, while the decode stage could still read memory pages reserved for the larger prompt. Some of those pages had not been cleared after earlier requests.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The report says the company found no evidence of deliberate exploitation. It also acknowledges that its long-context testing checked HTTP response codes and engine performance but did not validate the generated output for coherence.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how infrastructure errors can cross customer boundaries even when the underlying AI model is not itself at fault. Inference systems reuse GPU memory to handle large prompts efficiently. If an engine’s request tracking fails, memory left from one session can become visible to another, turning a performance optimization into a privacy risk.
For customers, the reported exposure means an AI response could contain material they did not provide, potentially including fragments of another user’s prompt or generated text. Such output may be difficult to recognize, particularly if it is mixed into an otherwise coherent answer. Cloudflare’s report describes a limited set of affected responses, but does not establish what specific information was present or whether any customer acted on it.
The issue also highlights the limits of testing that focuses on whether a service returns a successful response. Cloudflare said it observed successful long-context tests but had not checked the output’s coherence. In systems handling sensitive work, response status alone cannot establish that data stayed isolated; testing needs to examine generated content and failure paths as well.
Products Worth Considering
Apple MacBook Pro 16-inch Laptop with M5 Pro, 18-Core CPU, 20-Core GPU, 48GB Memory, 2TB SSD, Space Black
Trezor Safe 7 Crypto Hardware Wallet
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
As an affiliate, we earn on qualifying purchases.
How the KV Cache Failure Worked
A language model uses a key-value (KV) cache to store intermediate calculations from a prompt, avoiding repeated work as it generates an answer. Those calculations occupy GPU memory. Inference engines commonly divide the memory into pages that requests borrow and return. Cloudflare said pages were not zeroed between requests because the next request was expected to overwrite them, a practice it described as common and useful for performance.
Cloudflare ran the model in a disaggregated setup: one GPU group processed the prompt and built its cache, while another generated the response. The prompt could exceed the prefill pool’s capacity despite fitting the advertised context limit. The rejected request then passed through queues that checked whether it had finished, but not whether it had been rejected. Decode read more pages than prefill had written, exposing stale content in the remaining pages.
Cloudflare said the SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but that it became aware of it during its own investigation. The account of the incident therefore points to both a service-specific configuration mismatch and a flaw in the software path handling rejected requests.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare’s incident report
What Cloudflare Has Not Disclosed
Cloudflare’s report does not say how affected customers were notified, what categories of text appeared in the 155 responses, or whether the company can identify the users whose material was returned. It also does not provide a customer-by-customer account of exposure or say whether any information was sensitive.
The company said it found no evidence of deliberate exploitation, but that is a statement about its investigation, not proof that every affected response has been identified. The report’s description of requests as consistent with normal long-context use is based on timing and volume; it does not explain whether other logs or signals were available to establish the origin of each request.
The supplied incident account says a fixed version was restored, but it does not include the complete remediation details or independent confirmation of the fix. The precise scope beyond the reported 155 responses, and whether related deployments were reviewed, remains unclear from the published material.
Follow-Up on Customer Notification
The immediate next step for readers is any further disclosure from Cloudflare about customer notification, data categories and remediation checks. Cloudflare has reported that it removed the affected model from service after declaring the incident and restored a fixed version the same evening. The available account does not set out a schedule for additional updates.
Customers that used GLM-5.3 during the affected period may seek details directly from Cloudflare about whether their requests were involved and what the returned text contained. Further technical information about the fix, validation of the patched system, and any review of other services using the same inference engine would help clarify how broadly the failure could apply. No such additional findings are established in the supplied report.
Key Questions
What happened in the Cloudflare AI incident?
Cloudflare said its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The company attributed the issue to a cache-capacity mismatch and an SGLang bug.
Which requests could trigger the issue?
Cloudflare said the affected responses followed prompts longer than 681,280 tokens. That was the capacity of the prefill GPU memory pool, despite the service advertising a context window of 1,048,576 tokens.
Did Cloudflare say the incident was a deliberate attack?
No. Cloudflare said it found no evidence of deliberate exploitation. It described the requests, after excluding its tests and the researcher’s activity, as consistent in timing and volume with ordinary long-context use.
Did Cloudflare say how customers were notified?
The incident report described in the source material does not say how affected customers were told. It also does not identify the contents of the exposed text or provide a customer-by-customer breakdown.
Has the service been fixed?
Cloudflare said it took the model offline after declaring an incident and restored a fixed version later that evening. The supplied report does not provide independent confirmation of the fix or detailed results from follow-up testing.
Source: ThorstenMeyerAI.com
