🔍 Read the full analysis: Cloudflare’s KV Cache Bug: AI Answers And The Wrong Session on ThorstenMeyerAI.com
Get business pricing on office and shipping supplies
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare says a configuration mismatch and an SGLang inference-engine bug caused 155 responses from its hosted GLM-5.3 model to include text from other customers’ requests. The affected prompts exceeded 681,280 tokens; Cloudflare says it took the model offline, deployed a fix and found no evidence of deliberate exploitation. Its report does not explain how affected customers were notified.
Cloudflare says a bug in its hosted GLM-5.3 model on Workers AI caused 155 responses to contain data from other customers’ requests between August 27 and September 9, 2026. The company’s October 26 incident report attributes the exposure to a mismatch in its configuration and a bug in the open-source SGLang inference engine; only prompts longer than 681,280 tokens could trigger it.
Cloudflare said a security researcher reported the issue through its HackerOne program on September 8. The report described very long prompts sent to the GLM-5.3 endpoint sometimes receiving text associated with other users’ sessions. Cloudflare investigated and said it found 155 affected responses across the 14-day incident period. After excluding its own tests and the researcher’s activity, the company said the requests’ timing and volume were consistent with ordinary long-context use, rather than repeated exploitation.
The failure involved two conditions. Cloudflare advertised a context window of 1,048,576 tokens, but the memory pool used to store the model’s prompt-processing data had space for only 681,280 tokens. A separate SGLang bug allowed a request that exceeded available capacity to pass through parts of a distributed processing system after it had been rejected. In some cases, the system then read memory pages that still held data from earlier requests.
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a corrected version later that evening. The company’s report says it found no evidence that someone deliberately exploited the bug. The source report does not provide details on how Cloudflare contacted affected customers, or whether the company has determined what specific content each response exposed.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in the systems that serve an AI model can expose information even when the model itself is not the source of the defect. The issue was in memory allocation and request handling: data left in GPU memory was not cleared between requests, and the software was expected to keep each customer’s work separate by correctly tracking which memory pages belonged to which request.
For customers using hosted models, the reported impact is that a response could include text from another customer’s prompt or partial output. That matters because users may send code, business material or other sensitive information to an AI service. Cloudflare has not publicly specified the exposed content or identified affected customers in the source material, so the practical consequences for individuals and organizations remain uncertain.
The case also underlines a testing gap Cloudflare acknowledged. The company said its long-context checks validated HTTP response codes and engine performance, but did not validate the resulting model output and coherence. A successful response code, in other words, did not establish that the returned text belonged to the right session.
Popular right now
Roborock Q7 M5+ Robot Vacuum and Mop
Samsung 42-Inch Class OLED S90F 4K Smart TV (2025)
Dyson Cyclone V10 Origin Cordless Vacuum
As an affiliate, we earn on qualifying purchases.
A Long-Context Setup With Two Faults
A KV cache stores intermediate calculations a language model uses while processing a prompt and generating an answer. Because long prompts require substantial memory, inference systems divide that memory into pages and assign them to requests. Cloudflare said pages were not cleared after a request finished; the next request using a page was expected to overwrite its contents. That practice can support performance, but it relies on correct allocation and bookkeeping to prevent data from crossing between sessions.
Cloudflare ran GLM-5.3 in a disaggregated setup: one group of GPUs processed prompts and built the cache, while another group used that cache to generate responses. According to the report, an oversized prompt was marked as rejected and replaced with a one-token placeholder. In the split setup, queues checked whether a request had finished but not whether it had been rejected. The second stage had reserved space for the full prompt, while the first had written only the placeholder; the second stage could then read pages that still contained earlier users’ data.
Cloudflare’s report says the underlying SGLang issue had been reported publicly as issue #30233 on July 6, 2026. The company said it noticed that issue during its own investigation. The separate source material also describes a broader challenge for security programs: AI-generated vulnerability reports can add to the volume of submissions that people must review. That is a distinct problem from Cloudflare’s customer-data exposure, and it does not establish that AI caused or contributed to the KV-cache incident.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare’s incident report
Customer Impact Still Undisclosed
The report establishes the number of affected responses and the prompt-length threshold, but the source material does not say which customers received them, what information appeared in each answer, or whether any exposed material was subsequently accessed or retained. It also does not explain how customers were notified or what support Cloudflare offered to those affected.
Cloudflare said it found no evidence of deliberate exploitation, but that is the company’s finding, not proof that no one could have observed or used the data. The available account also does not provide an independent review of the incident or describe whether other models or configurations were checked for the same failure. Those details remain unconfirmed in the material provided.
Follow-Up on Fixes and Notice
Cloudflare said it restored a fixed version of the model on the evening of September 8, after taking it offline 38 minutes after declaring an incident. The incident period in its report runs through September 9, but the source material does not detail the precise rollout steps or provide a separate confirmation of when all affected traffic was clear.
The next questions for customers and security teams are whether Cloudflare will publish more information about customer notification, the content involved and any additional safeguards or testing introduced after the incident. The source report does not set out a date for further updates. Until those details are available, the scope beyond the reported 155 responses and the specific consequences for affected customers remain unresolved.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says a bug caused 155 GLM-5.3 responses on Workers AI to contain data from other customers’ requests between August 27 and September 9, 2026.
Which prompts could trigger the bug?
According to Cloudflare, the affected prompts were longer than 681,280 tokens, the capacity of the relevant KV-cache memory pool.
Did Cloudflare find evidence of deliberate exploitation?
Cloudflare said it found no evidence of deliberate exploitation. Its report described the affected requests, after excluding tests and the researcher’s activity, as consistent with ordinary long-context use.
How did Cloudflare respond?
Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. The source material does not describe how affected customers were notified.
What remains unknown about the exposure?
The available report summary does not identify affected customers or specify the exact content exposed in each response. It also does not explain customer notification or provide details of any independent review.
Source: ThorstenMeyerAI.com
