Your AI Answer in a Stranger’s Session: Cloudflare’s KV Cache Leak and the AI Spam Drowning Bug Hunters

By Thorsten Meyer | October 27, 2026 | ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Two stories from the same week show both sides of AI security. In one, a hosted AI model handed some customers text from other customers’ requests. In the other, the people who are supposed to catch bugs like that are buried under reports that AI wrote for them.

Key takeaways

• The leak: Between August 27 and September 9, 2026, Cloudflare’s hosted GLM-5.3 model on Workers AI returned 155 responses that contained data from other customers’ requests, according to Cloudflare’s own incident report published October 26.
• The cause: a configuration mismatch on Cloudflare’s side (a memory pool for 681,280 tokens behind a 1,048,576-token context window) plus a bug in the open-source inference engine SGLang. Only prompts longer than 681,280 tokens could trigger it.
• The response: a researcher reported it through HackerOne on September 8. Cloudflare took the model offline 38 minutes after declaring an incident and restored a fixed version the same evening. It says it found no evidence of deliberate exploitation. The report does not say how affected customers were told.
• The flood: Jump Crypto’s $1 million Firedancer audit contest drew 809 reports from 162 researchers, which boiled down to 127 unique findings. Jump believes AI agents found or wrote nearly every one. Its new bounty platform now makes researchers burn 1 SOL (about $100, per CoinDesk) per report.
• The pattern: curl dropped its bounty in January, Bugcrowd started banning “submission farming” in March, and HackerOne counted a record 46,947 submissions in March 2026. Finding bugs got cheap. Judging them did not.

Products Worth Considering

LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1

AmazonView Latest Price

Samsung 27-inch Odyssey OLED G6 QD-OLED QHD Gaming Monitor

AmazonView Latest Price

Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The answer that wasn’t yours

Imagine you paste a huge code base into a hosted AI model. The answer comes back fast and coherent, and part of it is built on somebody else’s prompt. You might not even notice.

That is roughly what happened to a small number of Cloudflare customers. On September 8, security researcher Gadi Evron of Knostic reported through Cloudflare’s HackerOne program that very long prompts sent to @cf/zai-org/glm-5.3 “sometimes returned text that belonged to other users’ sessions.” Cloudflare’s investigation found 155 affected responses over 14 days, all of them to prompts longer than 681,280 tokens. After excluding its own tests and the researcher’s, Cloudflare says the requests “are consistent in timing and volume with ordinary long-context use, not with someone repeatedly exploiting the bug.”

GLM is a text-generation model from Z.ai built for agentic coding, and the model itself did nothing wrong. In the Hacker News discussion, the account kflansburg (Kevin Flansburg co-wrote the report) explained that the title names the model only so customers know which endpoint was affected.

What a KV cache is, in plain words

When a language model reads your prompt, it turns every token into intermediate numbers, called keys and values, so it doesn’t have to re-read the whole prompt for every new word it writes. That stored work is the KV cache. For a million-token prompt it is enormous, and it lives in GPU memory.

To use that memory well, inference engines carve it into a shared pool of fixed-size pages. Each request borrows pages and hands them back when it finishes. Here is the detail that matters: per Cloudflare, “pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.” Cloudflare calls this common practice and “necessary to achieve the best performance.” It also means the engine’s bookkeeping is the only thing keeping one customer’s numbers away from the next customer. Think of a hotel that skips cleaning between guests because the next guest’s luggage will fill the room anyway. That works, as long as every guest really unpacks.

How the leak happened: two faults stacked

Cloudflare runs GLM-5.3 in a “disaggregated” setup. One pool of GPUs (prefill) reads the prompt and builds its KV cache. It then ships that cache over the network to a second pool (decode), which writes the answer.

Fault one was Cloudflare’s configuration. It advertised a context window of 1,048,576 tokens, but the KV pool on its prefill GPUs only had room for 681,280. Cloudflare says it knew about the mismatch before launch, expected the engine to return an error for anything that didn’t fit, and saw successful responses in its long-context tests. Its own admission: “we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.”

Fault two was in SGLang. A prompt that didn’t fit was marked as rejected and swapped for a one-token placeholder. On a single machine that produces an error. In the split setup, both admission queues only checked whether a request was finished, not whether it was rejected, so the rejected request sailed through. Decode had reserved pages for the full prompt (eight in Cloudflare’s example). Prefill wrote only one. Decode then read all eight, and seven of them still held “other users’ prompts and partial generations.” The client got HTTP 200 instead of an error, the token count matched the long prompt, and the reply was coherent. The only tell: it arrived faster than it should have.

The bug was not unknown. Another user had reported it to SGLang as issue #30233 on July 6, 2026, which Cloudflare says it only noticed during the investigation.

The response, and what the report leaves open

The timeline in Cloudflare’s report (all UTC) is fast once the alarm rang. The report arrived on September 8 at 23:11. Verification began the next morning at 08:00, an incident was declared at 13:22, and Product Security reproduced the leak with two independent accounts within 25 minutes. The model went private at 14:00, all prefill nodes were reconfigured by 14:52, a patched engine was validated against the researcher’s reproduction script at 19:04, and the model returned at 19:40.

The fix has two layers. Cloudflare resized the pool to about 2.04 million tokens, roughly twice the context window, so a valid prompt can no longer reach the faulty path. It also patched the engine so a rejected request is retired with its error before any memory is allocated or transferred. Upstream, SGLang shipped the fixes across v0.5.20 to v0.5.22 (v0.5.22 released October 19) and recommends every operator of disaggregated serving upgrade.

Credit where it’s due: this is an unusually candid report. Cloudflare names its own testing gap, publishes the timeline to the minute and tells other operators exactly what to check.

But the report also leaves questions open that matter to customers:

• Notification. It does not say whether, when or how the customers whose data showed up in other responses were told. Compare OpenAI in March 2023, which wrote that it had “reached out to notify affected users” after its own leak.
• Scope of victims. 155 responses received foreign data. How many customers’ requests contributed that data, and what kind of data it was, is not stated.
• Detection. The leak ran for 14 days until an outside researcher spotted it. SGLang’s own post says that for a related class of race conditions a deployer “has no reliable way to tell” whether exposure already occurred, because the corruption leaves no error or log line.

Not the first time a shared cache crossed users

Shared caches are a speed trick with a long history of privacy accidents. On March 20, 2023, a bug in the open-source Redis client redis-py let some ChatGPT users see titles from another active user’s chat history. OpenAI’s post-mortem of March 24, 2023 says the same bug may have exposed payment-related details of 1.2% of ChatGPT Plus subscribers who were active during a nine-hour window (never full card numbers).

AI’s own caches are a newer attack surface. Stanford researchers led by Chenchen Gu showed in Auditing Prompt Caching in Language Model APIs (ICML 2025) that cached prompts come back measurably faster, and detected caches shared globally across users at seven API providers, including OpenAI. That is a timing side channel, not a direct leak like Cloudflare’s, but it rests on the same tension: sharing makes inference cheap, and sharing is what crosses tenants.

In the Hacker News thread, several commenters described getting someone else’s answer from other providers. Those are unverified anecdotes, not evidence, but they show how hard such failures are to spot from outside.

Meanwhile, the people who catch these bugs are drowning

Note how the Cloudflare bug was found: one researcher, one HackerOne report, one reproducible script. That channel is under strain.

Jump Crypto builds Firedancer, an independent validator client for Solana that, by Jump’s count, secures 15% of the network’s stake. In its October 16 review Hardening Firedancer, Jump’s Ishan Bhatt describes a $1,000,000 public audit contest run from April 9 to May 9: 809 reports from 162 researchers, resulting in 127 unique security findings (excluding non-exploitable “insights”). Nearly half of the valid submissions were duplicates. Volume was roughly 20 times the 2024 contest, which ran two weeks longer. “We believe nearly every submission was either discovered or written by an agent,” Jump writes.

The numbers behind the frustration:

• At about 26 submissions a day, the backlog peaked at 299 open reports.
• Around 80% of duplicates arrived more than three days after the original, because unfixed bugs kept getting rediscovered by agents running the same models.
• Reports averaged 1,064 words without formatting and code (2,610 with), against 406 words before 2025.

The same tools find real flaws, too: Broccoli2Shell, the Brotli bug I covered on October 26, came out of OpenAI’s agent red-teaming. And the contest still found real bugs, including a scheduling flaw that could make Firedancer execute transactions out of order and disagree with other validators. As Bhatt puts it: “AI has made finding bugs cheap, but judging them is still expensive.”

Pay to report? Four answers to the flood

Firedancer charges. The contest already had a $100 fee and one report per researcher per day. Jump says the fee clearly didn’t deter serious researchers and that without it there would have been more, worse reports. Its new platform enforces a 1 SOL burn per submission and a 3,000-character limit per report section. The terms, effective October 26, say reports without a burn “will not be eligible for a bounty.” CoinDesk reports that the burn is nonrefundable even for invalid, out-of-scope or duplicate reports. At the same time, Jump doubled rewards until November 20 and tripled them for Alpenglow, Solana’s new voting system, where critical findings can now pay up to $300,000. One correction to the headlines: this is Jump’s Firedancer program, not a Solana Foundation or Anza policy. I found no announcement from either.

curl stopped paying. Daniel Stenberg ended curl’s bug bounty on January 31, 2026, after 87 confirmed vulnerabilities and more than $100,000 in rewards since 2019. The share of reports that turned out to be real fell from “north of 15%” to below 5% in 2025. He explicitly considered charging researchers and rejected it: payments are complicated internationally, add friction, and “would limit who could or would submit issues.” In October, curl went further and started handling minor flaws in the open, which I covered in CVEs Are Going to the Moon.

Bugcrowd bans. In a March 10 post, Bugcrowd said its queues had grown by more than 334% in three weeks and named the problem “sloptimism.” Its new rules: permanent bans for submission farming, review and possible 30-day suspensions after ten consecutive invalid reports, identity checks after ten invalid ones. It also says some firms used sock-puppet accounts to harvest its triage verdicts as training signals for their own AI.

HackerOne automates. HackerOne’s April data show a different picture: 46,947 submissions in March 2026, up 76% year over year, with a steady ~25% confirmed as valid and exploitable. Remediation throughput rose only 19%. Its answer is AI-assisted validation, and it told BleepingComputer that curl’s experience “is not representative” of enterprise programs.

The turn: speed against isolation, volume against trust

Both stories are about the same trade. Cloudflare’s leak came from optimizations that make AI cheap: shared GPU memory, unwiped pages, prompts split across machines. The bounty flood comes from AI making reports cheap. In both cases the expensive part, checking that what you got is really yours and really true, didn’t scale with the cheap part.

The isolation fixes turned out to be affordable in this case. SGLang measured the cost of its new deferred-release protection at −0.38%, statistically not significant. Cloudflare’s page-tagging prototype, which checks ownership on every read, cost under 1% in tests, but Cloudflare switched it off shortly after a mid-August trial “due to reliability issues.” Speed was not the obstacle there. Engineering effort was.

And the two stories meet in the middle: the Cloudflare fix exists because a human sent one precise report into a channel that thousands of machine-written reports are now clogging.

What this means for companies

If you send data to hosted AI models, ask your providers five questions:

1. Tenant isolation: Do you run our requests on shared GPUs, and what stops another customer’s request from reading our KV cache? Do you zero or tag memory pages?
2. Cache scoping: Is prompt caching shared across customers, or scoped to our account? Can we turn it off?
3. Testing: Do you test long-context limits for correct output, not just for HTTP 200?
4. Incident disclosure: Will you notify us individually if our data appeared in someone else’s response, and within what time?
5. Retention: How long do prompts, outputs and caches live, and in which logs?

For data that must never cross tenants, dedicated or on-premise inference is an option, with costs I looked at in IBM’s case for running AI yourself. If you run SGLang in disaggregated mode yourself, follow Cloudflare’s operator list: compare KV pool and context length on every node, and upgrade to v0.5.22 or later.

If you run a security inbox or bounty, plan for volume: a short report template with a hard length cap, a mandatory reproducible proof of concept, automated first-pass triage (Jump says it “never saw an LLM discard a valid finding” when its team pasted reports into an agent by hand), fast public fixes so agents stop rediscovering the same bug, and a reputation fast lane for researchers with a track record. A deposit or burn works for a crypto project with paid bounties; for a volunteer open-source project, curl’s reasons against fees deserve weight.

What this means for users

• Don’t put secrets into hosted models. Passwords, API keys, client records and health data don’t belong in a prompt, no matter how good the provider’s reputation. This leak needed no attacker.
• Long-context tools are the exposed edge. Pasting whole repositories or document piles is exactly the workload that triggered this bug. Strip credentials before you do.
• If a provider reports an incident, check whether your account used the affected model in the affected window, rotate any credentials you pasted, and ask the provider directly whether your requests were involved.
• Strange answer? Keep it. A coherent reply that clearly isn’t about your question can be a symptom. Screenshot it and report it to the provider’s security channel. Short and reproducible, please.

Honest limits

Almost everything about the leak comes from Cloudflare’s and SGLang’s own posts; the researcher’s write-up was not yet published. The 155 responses, the “no deliberate exploitation” finding and the scope are Cloudflare’s claims. I could not verify them independently. The Firedancer figures are Jump’s own; the “nearly every submission” AI estimate is Jump’s belief, not a measurement. The burn’s dollar value and the nonrefundable reading come from CoinDesk. HackerOne’s and Bugcrowd’s numbers come from their own platforms. The Hacker News anecdotes are unverified.

Verdict

Cloudflare made a basic mistake, tested the wrong thing, and then handled the aftermath better than most of the industry: fast shutdown, minute-by-minute timeline, upstream fixes for everyone. The missing piece is the customer notification. The bigger lesson sits in the second story. AI infrastructure is getting faster and denser, and the security reports that should keep it honest are getting louder and worse. Whoever can still hear the one real report in the noise will catch the next leak.

Sources

• Cloudflare: Cross-request KV cache exposure in the GLM-5.3 Workers AI model, and our remediation with SGLang (October 26, 2026)
• SGLang / LMSYS: Cross-request KV cache leakage in SGLang PD disaggregation (October 26, 2026)
• SGLang: GitHub issue #30233 (July 6, 2026)
• Hacker News: discussion of Cloudflare’s report (October 26–27, 2026)
• OpenAI: March 20 ChatGPT outage: Here’s what happened (March 24, 2023)
• Gu, Li, Kuditipudi, Liang, Hashimoto: Auditing Prompt Caching in Language Model APIs (ICML 2025)
• Jump Crypto, Ishan Bhatt: Hardening Firedancer (October 16, 2026)
• Firedancer: Bug Bounty Terms & Conditions (version effective October 26, 2026)
• CoinDesk: Solana bug reports now cost 1 SOL as AI floods security teams with spam (October 27, 2026)
• Daniel Stenberg: The end of the curl bug-bounty (January 26, 2026)
• Bugcrowd, Trey Ford: Bugcrowd policy changes to address “AI slop” submissions (March 10, 2026)
• HackerOne: Continuous Threat Exposure Management and the Remediation Crisis (April 15, 2026)
• BleepingComputer: Curl ending bug bounty program after flood of AI slop reports (January 2026, HackerOne statement added January 28)
• Related on ThorstenMeyerAI.com: Broccoli2Shell: one compression bug reaches Node.js, Python and beyond · CVEs Are Going to the Moon