🔍 Read the full analysis: Why Cloudflare’s KV Cache Leak Matters To AI Users on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare’s October 26 incident report says its hosted GLM-5.3 model returned text from other customers’ requests in 155 responses between August 27 and September 9, 2026. The issue required prompts longer than 681,280 tokens and resulted from a Cloudflare configuration mismatch combined with a bug in the SGLang inference engine. Cloudflare says it found no evidence of deliberate exploitation, but its report does not describe how affected customers were notified.
The issue affected requests to Cloudflare’s **Workers AI** endpoint for GLM-5.3, a text-generation model built by Z.ai. According to Cloudflare, every affected response followed a prompt longer than **681,280 tokens**. The company’s report says it excluded its own tests and the researcher’s requests when examining the 155 responses, which it described as consistent in timing and volume with ordinary long-context use rather than repeated attempts to exploit the bug.
Security researcher **Gadi Evron of Knostic** reported the problem through Cloudflare’s HackerOne program on September 8, after observing that very long prompts could produce text from other users’ sessions. Cloudflare began verification the following morning, declared an incident at 13:22 UTC, and took the model offline **38 minutes after declaring the incident**. It restored a fixed version later that evening, according to the source report.
Cloudflare traced the leak to two faults that interacted. Its setup advertised a context window of **1,048,576 tokens**, but the prefill GPUs’ key-value (KV) memory pool could hold only 681,280. Separately, SGLang mishandled oversized requests in Cloudflare’s split prefill-and-decode configuration: one part of the system treated a rejected request as a one-token placeholder, while the next part checked whether processing had finished but not whether the request had been rejected. The decode stage could then read cache pages that had not been overwritten.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
The incident matters because a hosted AI request can contain **source code, internal documents, customer records or other sensitive material**. Cloudflare’s report does not establish what particular information appeared in the leaked responses, but text from another customer’s prompt or partial generation could be confidential. Users generally cannot inspect the model provider’s GPU memory handling, so they depend on the service’s isolation controls to keep requests separate.
The case also illustrates how **configuration and software defects can combine**. The model itself was not identified as the cause: Cloudflare attributed the failure to its deployment settings and SGLang’s handling of rejected requests across separate processing stages. A successful HTTP response and coherent-looking output did not guarantee that the answer was built only from the current user’s input. Cloudflare noted that the unusual speed of the response was a possible tell, but users should not treat response speed as a dependable way to detect a leak.
For AI customers, the practical consequence is a reason to ask providers how they isolate requests, test long-context configurations and respond to security incidents. It is not evidence that every hosted model or every long prompt is vulnerable. Cloudflare said the affected condition was limited to prompts over the stated threshold, and the company reports that it removed the model and restored a fix.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Logitech MX Keys S Wireless Keyboard, Graphite
Jackery HomePower 1000 Plus v2 Portable Power Station
As an affiliate, we earn on qualifying purchases.
How the KV Cache Failure Unfolded
A language model stores intermediate calculations as **keys and values** while processing a prompt, allowing it to generate later words without repeatedly processing the entire input. That stored material is the KV cache. For long prompts, it can consume substantial GPU memory. In the configuration described by Cloudflare, the memory was divided into fixed-size pages that requests could use and then return.
Cloudflare said those pages were **not zeroed between requests**; the next request was expected to overwrite them. That approach, which the company described as common and useful for performance, relies on correct tracking of which pages belong to which request. When an oversized prompt was rejected in the prefill stage but passed into the decode stage as a placeholder, the latter reserved space for the full prompt while prefill wrote only one token. Cloudflare’s example says decode read eight pages, seven of which still held other users’ prompts or partial generations.
The source report says a similar SGLang problem had been filed as issue **#30233 on July 6, 2026**. Cloudflare said it noticed that report only while investigating its own incident. The source also describes a separate, contemporaneous pressure on security teams: a Jump Crypto audit contest drew 809 reports from 162 researchers, which the firm said reduced to 127 unique findings and which it believed were largely found or written by AI agents. That episode is not part of the Cloudflare leak, but it points to a related challenge: more AI-generated reports can increase the workload of reviewing and verifying security findings.
“Pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.”
— Cloudflare’s incident report
Customer Notices and Exposure Details Remain Unreported
Cloudflare’s report, as described in the source material, does not say **how affected customers were notified**, whether all recipients of the 155 responses could be identified, or what specific customer information appeared in each response. It also does not provide a public account of any downstream use of the leaked text. Those details should not be inferred from the response count alone.
The company says it found no evidence of deliberate exploitation and describes the requests as consistent with ordinary long-context use. That is Cloudflare’s assessment, not proof that no one attempted to trigger the condition. The source material also does not give a full independent verification of the company’s review, or detail the precise scope of the fix beyond restoration of a fixed model version.
The reported threshold and count apply to the incident Cloudflare investigated. The material does not establish whether other models, endpoints or providers had the same defect. Nor does it show that a normal-length prompt could trigger the reported behavior.
What Cloudflare and Customers Should Clarify
The next public details that would help customers assess the incident include **notification procedures**, the categories of information found in affected responses and how Cloudflare confirmed the fix across the relevant configurations. The company’s report says the corrected model was restored on the evening of September 9, but the source material does not identify a further scheduled update or a separate review date.
Customers that used the affected GLM-5.3 endpoint during the incident window can consult Cloudflare’s incident report and contact the provider about whether their requests were involved. They may also review what they submitted, particularly if they used prompts exceeding 681,280 tokens, while avoiding assumptions that every request above that length leaked data. The incident report identifies the condition associated with affected responses, not a claim that all such prompts were exposed.
For service providers, the disclosed failure points toward specific checks: verify that advertised context limits match available memory, test generated content rather than only HTTP status and performance, and confirm that rejected requests cannot proceed through later processing stages. Whether Cloudflare or SGLang publishes additional technical findings, and whether the affected customers receive further information, remains unclear from the available report.
Key Questions
What happened in the Cloudflare KV cache incident?
Cloudflare says its hosted **GLM-5.3 model returned text from other customers’ requests in 155 responses** between August 27 and September 9, 2026. The affected responses followed prompts longer than 681,280 tokens.
What caused the leak?
Cloudflare attributed it to a **mismatch between the advertised context window and the available KV cache memory**, combined with a bug in SGLang’s handling of rejected requests in a split processing setup.
Was the GLM-5.3 model itself responsible?
Cloudflare’s account points to its deployment configuration and the inference engine, **not a defect in the model itself**. The report identifies the model endpoint involved, but does not attribute the leak to the model’s generated behavior.
Did Cloudflare find evidence of an attack?
Cloudflare said it found **no evidence of deliberate exploitation** and that the requests were consistent with ordinary long-context use. This is the company’s assessment; the source material does not provide an independent review of that conclusion.
What remains unknown about affected customers?
The report, as summarized in the available material, does not state **how customers were notified**, what specific information appeared in each response, or whether the company will publish more detail about the affected requests.
Source: ThorstenMeyerAI.com
