🔍 Read the full analysis: Cloudflare’s KV Cache Leak Raises Questions About AI Privacy on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. The company attributed the leak to a context-window configuration mismatch combined with a bug in the SGLang inference engine; it says it found no evidence of deliberate exploitation.
Cloudflare says 155 responses from its hosted GLM-5.3 model contained data from other customers’ requests during a 14-day period in 2026. In an incident report published October 26, the company attributed the exposure to a mismatch in its context-window configuration and a bug in the open-source SGLang inference engine, raising questions about how shared GPU memory is isolated in hosted AI services.
The affected service was GLM-5.3 on Cloudflare Workers AI, a text-generation model developed by Z.ai. Cloudflare’s report says the affected responses were produced between August 27 and September 9, and that the issue could be triggered only by prompts longer than 681,280 tokens. Security researcher Gadi Evron reported the behavior through Cloudflare’s HackerOne program on September 8.
Cloudflare described two faults acting together, highlighting broader questions about AI data egress. Its prefill GPU pool had memory for 681,280 tokens, while the model endpoint advertised a context window of 1,048,576 tokens. Separately, SGLang mishandled requests that exceeded available memory in Cloudflare’s split prefill-and-decode setup. The request was marked rejected but could continue through queues that checked whether it had finished, not whether it had been rejected.
As a result, the decode pool could read cache pages that had not been overwritten for the rejected request. Cloudflare says those pages still held other users’ prompts and partial generations. The service returned an HTTP 200 response rather than an error. Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version later that day, according to the report.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident shows how a failure in the systems around a model can expose customer data even when the model itself is not the source of the defect. In this case, memory allocation and request handling determined whether one customer’s inference data stayed separate from another’s. The issue was limited to a particular model endpoint and very long prompts, according to Cloudflare’s account; it is not evidence that all Workers AI requests or other Cloudflare services were affected.
For organizations sending source code, business records or other sensitive material to hosted models, the report is relevant to provider security and data isolation. A successful response and a normal-looking output do not, by themselves, establish that every stage of processing handled a request as intended. The incident also highlights the need for tests that check output and isolation—not only whether an endpoint responds successfully or meets performance targets.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Jackery Explorer 300 Portable Power Station, 292Wh
Apple iPad Air (4th Generation, 10.9-inch, Wi-Fi, 256GB) – Space Gray
As an affiliate, we earn on qualifying purchases.
How the KV Cache Was Exposed
A key-value (KV) cache stores intermediate calculations a language model uses while processing a prompt, allowing it to generate text without repeatedly processing the entire input. It can occupy substantial GPU memory for long prompts. In the setup described by Cloudflare, separate GPU pools handled prompt processing and response generation, with the cache transferred between them.
Cloudflare said cache pages are not zeroed between requests; the next request using a page is expected to overwrite its contents. The company described that approach as common and useful for performance. The exposure arose when the rejected request did not write the full cache that the decode pool expected to read. Cloudflare said it had known about the context-window and pool-size mismatch before launch, but its long-context testing checked HTTP response codes and engine performance without validating the model’s output and coherence.
The company also said the underlying SGLang issue had been reported publicly as issue #30233 on July 6, 2026, but that it noticed the report only while investigating the incident. Cloudflare’s October 26 disclosure described the incident response and technical cause; the supplied account does not include a separate statement from SGLang.
““we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.””
— Cloudflare incident report
Scope and Customer Notification
Cloudflare said it found no evidence of deliberate exploitation, but the report’s account of traffic is the company’s assessment; it does not establish who, if anyone, saw or retained exposed content. The supplied report does not say how affected customers were notified, identify them, or detail what data appeared in each response. It also does not specify whether the 155 responses represent 155 distinct customers or requests.
The available information does not establish whether other models or deployments using the same inference engine were affected. Cloudflare attributed the event to the interaction between its configuration and an SGLang bug, but further details about any upstream fix, independent review, or customer remediation are not provided in the source material.
Fixes and Disclosure Follow-Up
Cloudflare says it restored a fixed version of the model on the evening it took the endpoint offline. The next points to watch are any further details from Cloudflare about customer notification and remediation, and whether it reports changes to long-context validation or cache isolation. The source material does not give a date for additional disclosures.
Further information from the maintainers of SGLang could clarify how the rejected-request handling defect is addressed across deployments. Until more is disclosed, the confirmed scope remains the 155 responses Cloudflare identified on the GLM-5.3 Workers AI endpoint during the stated period.
Key Questions
What happened in the Cloudflare incident?
Cloudflare says 155 GLM-5.3 responses returned data from other customers’ requests between August 27 and September 9, 2026. The company traced the issue to a configuration mismatch combined with a bug in SGLang.
What kind of prompt could trigger the issue?
According to Cloudflare, the affected requests had to be longer than 681,280 tokens. The incident report does not describe the issue as affecting every request to the model.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the affected traffic as consistent with ordinary long-context use. That is the company’s assessment, not an independent finding provided here.
Has Cloudflare fixed the affected endpoint?
Cloudflare says it took the model offline after declaring an incident and restored a fixed version later that day. The supplied report does not detail all remediation steps or say how affected customers were notified.
Source: ThorstenMeyerAI.com
