🔍 Read the full analysis: A Look At The AI Answer Leak And Spam Flood Facing Bug Hunters on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Cloudflare says its hosted GLM-5.3 model returned 155 responses containing text from other customers’ requests between August 27 and September 9, 2026. Separately, Jump Crypto says AI agents likely generated or found nearly all reports in a large Firedancer audit contest, prompting a 1 SOL submission fee on its new platform. The cases show different security pressures: preventing data exposure in AI services and sorting useful bug reports from automated submissions.
Cloudflare’s incident report says the exposure affected requests to @cf/zai-org/glm-5.3 between August 27 and September 9, 2026. A researcher, Gadi Evron of Knostic, reported the issue through Cloudflare’s HackerOne program on September 8, saying very long prompts sometimes produced text from other users’ sessions. Cloudflare counted 155 affected responses; it says all involved prompts longer than 681,280 tokens.
The failure involved two conditions. Cloudflare configured a context window of 1,048,576 tokens, although the prefill GPU memory pool for the model had capacity for 681,280. A bug in SGLang, the open-source inference engine, then allowed rejected oversized requests to proceed through a split prefill-and-decode setup. Cloudflare says decode read cache pages that prefill had not overwritten, exposing text left from other requests.
Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version that evening, according to the source report. The company said it found no evidence of deliberate exploitation. It also said the affected requests’ timing and volume were consistent with ordinary long-context use, rather than repeated attempts to exploit the bug. The report does not specify how or when affected customers were notified.
In the separate contest, Jump Crypto’s $1 million Firedancer audit challenge received 809 submissions from 162 researchers. Jump said those submissions resolved into 127 unique findings and that it believes AI agents found or wrote nearly all of them. Its new bounty platform requires researchers to spend 1 SOL per report, described in the source as about $100, as a measure against low-quality or automated submissions.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Two Pressures on Security Teams
The incidents point to different consequences of AI’s growing role in software security. Cloudflare’s case shows how a failure in infrastructure and request handling can expose data from one customer to another, even when the model itself is not identified as the cause. For users of hosted AI services, the episode makes implementation details such as memory management, configuration checks and error handling part of the privacy risk.
The Jump contest highlights a separate operational strain: more submissions do not necessarily mean more distinct vulnerabilities. Reviewers still have to validate, reproduce and prioritize each report. If AI tools make report generation cheap while human verification remains labor-intensive, programs may respond with fees, stricter triage or new rules. Those measures can reduce noise, but could also affect legitimate researchers if applied without care.
Together, the cases matter to security teams and customers because they show that AI can raise the stakes on both sides of the process: systems using AI must protect data across requests, while organizations receiving AI-assisted reports need ways to separate useful findings from duplicates and unsupported claims.
Popular right now
Dyson Ball Animal 2 Plus Corded Vacuum
Dyson Ball Animal 3 Extra Upright Vacuum
Ninja Luxe Café Premier 3-in-1 Espresso Machine, Drip Coffee & Cold Brew
As an affiliate, we earn on qualifying purchases.
How Cache Handling Failed
Cloudflare’s report describes a key-value (KV) cache as intermediate data a model stores while processing a prompt and generating text. In the reported setup, GPU memory was divided into pages that requests borrowed and returned. Cloudflare said those pages were not cleared between requests; the design depends on the next request overwriting them.
That practice became a problem when the oversized prompt was rejected by one part of the system but continued through the separate decode queue. According to Cloudflare, the prefill stage wrote only one token while decode had reserved pages for the larger request. The mismatch let decode read pages that still held data from other sessions. The source report says a related SGLang issue had been filed on July 6, 2026, and Cloudflare noticed it during its investigation.
The bug-bounty example fits a wider pattern described in the source material. Curl ended its bounty program in January, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded a record 46,947 submissions in March 2026. These are separate developments, not proof that every recent report was AI-generated; they show why platforms and bounty operators are adjusting how they handle volume.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare incident report
Customer Notice and Contest Review
Cloudflare’s public report, as summarized in the source material, does not explain how affected customers were notified, what kinds of request content appeared in the exposed responses, or how many customers were affected. The company said it found no evidence of deliberate exploitation, but that statement does not establish that every exposed response was viewed or used by an unintended recipient.
It is also unclear whether the 155 responses contained complete prompts, partial text or other sensitive details in each case. The source report gives a technical trigger and response count but does not provide a customer-by-customer impact assessment. Cloudflare’s statement that activity looked consistent with ordinary use is the company’s characterization of the observed timing and volume.
For Jump Crypto, the source material does not detail how the 127 unique findings were validated, how many were accepted as security issues, or how the new 1 SOL fee will affect participation. Jump’s belief that AI agents contributed to nearly every report is an assessment, not a breakdown of independently verified AI use.
Fixes and Triage Changes Ahead
Cloudflare says it restored a fixed GLM-5.3 version the evening it handled the incident. The public account does not set out a further timetable for customer notifications or additional disclosure, so those details remain open. The technical points to watch are whether Cloudflare expands output validation for long-context requests and how the SGLang rejection-path bug is addressed across affected deployments.
Jump Crypto’s new platform will apply the reported 1 SOL per-report charge as it processes future submissions. The source material does not state whether the policy will change or provide results from its use. More broadly, bounty programs and audit organizers are likely to keep adjusting submission rules and review practices as AI tools make it easier to produce reports at scale.
For readers using hosted AI services, the immediate takeaway is to look for provider disclosures about incident scope, affected systems and customer notification. For researchers, the contest shows that programs may place greater weight on reproducibility and distinct findings, not raw submission counts.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare reported that 155 responses from its hosted GLM-5.3 service contained text from other customers’ requests between August 27 and September 9, 2026. The company attributed the incident to a memory-capacity configuration mismatch combined with a bug in SGLang.
Did Cloudflare say the model itself caused the leak?
No. The source report attributes the failure to Cloudflare’s configuration and the inference engine’s request handling, not to the underlying GLM model generating another customer’s text by design.
How did Cloudflare respond?
According to the source material, Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. The company said it found no evidence of deliberate exploitation.
Why is Jump Crypto charging for reports?
Jump’s Firedancer contest received 809 submissions that the company grouped into 127 unique findings. Jump said it believes AI agents found or wrote nearly all the reports; its new platform requires 1 SOL per submission, reportedly about $100, to address report volume.
What remains unknown about the leak?
The source material does not say how affected customers were notified, how many customers were affected, or what specific information appeared in each response. It also does not independently establish whether any exposed text was accessed or used by another customer.
Source: ThorstenMeyerAI.com
