🔍 Read the full analysis: How AI Spam Is Drowning Out Bug Hunters on ThorstenMeyerAI.com
Prime made for students and young adults
- Fast, free delivery for dorm and study essentials
- Prime Video and Amazon Music included
- Member-only deals
TL;DR
Cloudflare reported that its hosted GLM-5.3 service returned 155 responses containing other customers’ request data between Aug. 27 and Sept. 9, 2026, after a configuration mismatch combined with an SGLang bug. Separately, Jump Crypto said AI agents likely found or wrote nearly all reports in a 809-submission Firedancer audit contest, underscoring the growing cost of sorting valid findings from AI-generated reports.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between Aug. 27 and Sept. 9, 2026. The disclosure, published Oct. 26, comes as a separate Jump Crypto audit contest highlights how AI-generated bug reports are adding work for security reviewers: the contest received 809 submissions that were reduced to 127 unique findings.
Cloudflare said the leak required prompts longer than 681,280 tokens. Its incident report attributed the issue to two faults: a mismatch between the model’s advertised 1,048,576-token context window and the smaller memory pool available for its key-value cache, and a bug in the open-source inference engine SGLang. The model itself was not identified as the source of the problem.
Security researcher Gadi Evron of Knostic reported the issue through Cloudflare’s HackerOne program on Sept. 8. Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version later that day. The company said it found no evidence of deliberate exploitation; it described the affected requests as consistent in timing and volume with ordinary long-context use.
The workload facing bug reviewers is illustrated by Jump Crypto’s $1 million Firedancer audit contest, which drew 809 reports from 162 researchers. Jump said those submissions amounted to 127 unique findings and that it believes AI agents found or wrote nearly every report. The source account says Jump’s new bounty platform charges researchers 1 SOL per report, about $100 according to CoinDesk. That fee is a platform policy, not proof that any particular submission was AI-generated.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Why Review Queues Are Under Pressure
The two developments point to different parts of the security workload. Cloudflare’s incident shows how a failure in inference infrastructure can expose data across customer requests, while the Jump contest illustrates how AI tools can increase the number of submissions that security teams must examine. The first is a reported service incident; the second is a contest organizer’s assessment of its submissions.
For bug bounty programs, a higher report count does not automatically mean more vulnerabilities have been found. Jump’s 809 submissions yielded 127 unique findings, so reviewers still had to identify duplicates and judge whether reports described real, actionable flaws. If writing a plausible report becomes cheaper while validation remains labor-intensive, programs may need stronger triage processes or submission rules. The source material does not quantify the review time or costs involved.
For customers using hosted AI systems, the Cloudflare case underlines why operational tests should check the content of model responses, not only whether a request returns successfully. Cloudflare said its long-context testing checked HTTP response codes and engine performance but did not validate output and coherence. That gap mattered because affected requests returned HTTP 200 responses rather than clear errors.
Popular right now
Roborock Robot Vacuum and Mop with LiDAR Navigation and 10,000 Pa Suction
Vitamix 5200 Professional-Grade Blender, 64 oz. Container, Black
Dyson Car+Boat Cordless Handheld Vacuum
As an affiliate, we earn on qualifying purchases.
Two Security Pressures in One Week
The Cloudflare incident involved the model’s KV cache, a store of intermediate data used to generate text without rereading the full prompt for every output token. Cloudflare said cache pages were not zeroed between requests; the next request was expected to overwrite them. In its split prefill-and-decode setup, the undersized pool led one component to reserve cache pages for a long prompt while another wrote only a one-token placeholder after rejecting it. The report says the decode stage then read pages that still contained other users’ prompts and partial generations.
Cloudflare said the configuration mismatch was known before launch. The company expected the inference engine to return an error for prompts that exceeded available memory, and said its tests had produced successful long-context responses. During its investigation, it also found that the related SGLang bug had been reported as issue #30233 on July 6, 2026. Cloudflare said it had not noticed that issue before investigating its own incident.
The submission surge has been visible elsewhere in the security industry, according to the source material. curl ended its bug bounty in January, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those figures describe different programs and measures; they do not establish that every submission was AI-generated or that AI alone caused the increases.
“We only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.”
— Cloudflare incident report
What the Reports Do Not Establish
Cloudflare’s report, as summarized in the source material, does not say how affected customers were notified, how many distinct customers received exposed text, or whether the company has completed any further review of possible impact. Cloudflare said it found no evidence of deliberate exploitation, but that statement does not establish that every affected response was identified or that no data was viewed by unintended recipients.
It is also unclear how many of Jump Crypto’s contest reports were fully or partly generated by AI, how the company determined that AI agents were involved, and what criteria it used to count 127 unique findings. The claim that AI was involved in nearly every report is attributed to Jump, and should not be treated as an independently confirmed breakdown. The cited submission totals from other programs likewise do not show what share was AI-assisted.
The source gives no baseline or comparable review-time data for the contest, so the volume figures alone cannot establish how much extra work AI caused. The stated 1 SOL fee may deter low-effort or duplicate submissions, but its effect on report quality and participation has not been provided.
Fixes and Triage Measures Ahead
Cloudflare said it restored a fixed version of GLM-5.3 on the evening it responded to the incident. The next questions for customers and security teams are whether the company will provide more detail on notification and impact, and how it will test long-context requests across the separate stages of its inference system. Its published account describes the fix and response, but the source material does not set out a further public timeline.
For bug bounty programs, Jump Crypto’s per-report fee offers one approach to limiting submission volume, while other programs have used rules against submission farming. Whether those measures preserve access for legitimate independent researchers while reducing low-value reports remains to be seen. More detail on validation standards, review costs and the share of confirmed findings tied to AI tools would help distinguish a larger submission count from a meaningful increase in security discoveries.
Key Questions
What data did Cloudflare say was exposed?
Cloudflare said 155 responses contained data from other customers’ requests. Its report, as summarized in the source material, does not specify how many customers were affected or describe the full contents of the exposed data.
How did the Cloudflare leak happen?
Cloudflare attributed it to a memory-pool and context-window mismatch combined with a bug in SGLang. The company said prompts longer than 681,280 tokens could trigger the issue in its split inference setup.
Did Cloudflare say the leak was deliberate?
No. Cloudflare said it found no evidence of deliberate exploitation and described the affected requests as consistent with ordinary long-context use. The report does not establish that every possible exposure was identified.
What did Jump Crypto say about AI and the audit reports?
Jump said its $1 million Firedancer contest received 809 reports from 162 researchers, amounting to 127 unique findings. The company believes AI agents found or wrote nearly every report, but the source material does not provide an independently verified breakdown.
Does a higher number of bug reports mean more bugs were found?
Not necessarily. In Jump’s contest, 809 submissions became 127 unique findings. Report volume alone does not show how many submissions were valid, exploitable or useful to the project.
Source: ThorstenMeyerAI.com
