🔍 Read the full analysis: Can Bug Hunters Keep Up With The AI Spam Flood? on ThorstenMeyerAI.com
Get business pricing on tech for your team
- Business-only prices and quantity discounts
- Tax-exempt purchasing
- Multiple users, one account, clear invoices
TL;DR
Cloudflare reported that its hosted GLM-5.3 service returned 155 responses containing data from other customers’ requests between August 27 and September 9, 2026. In a separate example of AI’s impact on security work, Jump Crypto said nearly all reports in a Firedancer audit contest appeared to involve AI, prompting its new bounty platform to charge a 1 SOL submission fee.
Cloudflare disclosed a cross-customer data leak in its hosted GLM-5.3 model, while a separate security contest exposed how AI-generated submissions are adding to the work of bug reviewers. Cloudflare counted 155 affected responses over 14 days; Jump Crypto said nearly every report in a recent audit contest was found or written with AI agents.
Cloudflare’s incident report, published October 26, says the affected responses came from its Workers AI endpoint for GLM-5.3 between August 27 and September 9. The leak could occur only when a prompt exceeded 681,280 tokens. Security researcher Gadi Evron reported the issue through Cloudflare’s HackerOne program on September 8 after observing responses that sometimes included text from other users’ sessions.
Cloudflare attributed the incident to two faults working together: its prefill GPU memory pool was smaller than the advertised context window, and the open-source inference engine SGLang mishandled rejected requests in Cloudflare’s split prefill-and-decode setup. The company says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that day. It reported no evidence of deliberate exploitation.
The separate workload problem appeared in Jump Crypto’s $1 million Firedancer audit contest. The contest received 809 reports from 162 researchers, which Jump said amounted to 127 unique findings. Jump believes AI agents found or drafted nearly all the submissions. Its new bounty platform charges 1 SOL per report, about $100 at the value cited by CoinDesk, as a way to discourage low-quality volume. That approach may reduce submissions, but it also places a cost on researchers reporting genuine issues.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
Security Teams Face Two AI Pressures
Together, the cases point to two distinct pressures: AI systems can create or expose security risks, and AI tools can make it cheaper to generate security reports. The Cloudflare incident involved a flaw in infrastructure handling customer requests, not a defect in the GLM model itself. Still, it shows how a configuration gap and an inference-engine bug can combine to expose information across sessions.
For security teams, more submissions do not automatically mean more useful findings. Jump’s contest produced 127 unique findings from 809 reports, leaving reviewers to distinguish valid issues from duplicates and weak reports. When review capacity is limited, a surge in submissions can slow triage of genuine vulnerabilities. Fees may filter some low-value reports, but could also deter independent researchers who cannot afford to pay per submission.
The practical challenge is therefore not simply whether AI can find bugs. Organizations must also test the systems that serve AI models, verify outputs rather than relying only on successful HTTP responses, and build review processes that can handle a larger volume of machine-assisted submissions.
Products Worth Considering
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Jackery HomePower 3600 Plus Portable Power Station, 3584Wh, 3600W
Samsung 27 Odyssey OLED G5 (G50SF) QHD QD-OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
From Model Leak to Report Overload
Cloudflare’s explanation centers on the KV cache, the GPU memory where a model stores intermediate information from a prompt so it can generate a response efficiently. Cloudflare says cache pages are not zeroed between requests; the next request is expected to overwrite them. The company described that as a common performance practice, making correct memory allocation and request handling essential to keep one customer’s data separate from another’s.
In this case, Cloudflare configured a context window of 1,048,576 tokens but had a prefill cache pool sized for 681,280. The company expected oversized requests to fail. According to its report, SGLang replaced an oversized prompt with a one-token placeholder, but the split processing queues checked whether a request had finished rather than whether it had been rejected. Decode then read cache pages that prefill had not overwritten.
The submission surge is part of a wider pattern described in the source report. Curl ended its bug bounty program in January 2026, Bugcrowd began banning what it calls “submission farming” in March, and HackerOne recorded 46,947 submissions in March 2026. Those examples indicate growing concern about report volume, though the count alone does not establish how many reports were AI-generated or how many were valid.
““pages are not currently zeroed between requests; the next request that gets a page simply overwrites it.””
— Cloudflare, in its incident report
Customer Notices and Report Quality
Cloudflare’s report does not specify how or when affected customers were notified, nor does the supplied information identify how many customers received data from other sessions. The company said it found no evidence of deliberate exploitation, but that does not establish that every affected response was seen or that no data was retained by recipients.
It is also unclear how many of Jump Crypto’s 127 unique findings were independently validated as vulnerabilities, how the company determined AI’s role in each report, or whether the 1 SOL fee will change the quality and range of submissions. The examples show a real review burden, but they do not establish that AI-generated reports are generally invalid or that submission fees are the best remedy.
Fix Verification and Bounty Review
Cloudflare says it restored a fixed version of the model on the day of the incident response. The next points for readers to watch are any further disclosure about customer notification, the scope of affected data, and changes to testing for long-context requests. Cloudflare’s report also says the underlying SGLang issue had been reported to the project in July; the supplied account does not state the project’s current remediation status.
Jump Crypto’s new platform will show whether a per-report fee reduces duplicate or low-value submissions without shutting out researchers with legitimate findings. More broadly, bug bounty organizers and model operators will need to show how they are validating reports and testing data separation. For now, the confirmed record is one disclosed hosted-model incident and one contest’s unusually large, AI-associated report volume—not a complete measure of AI’s effect on security research.
Key Questions
What happened in Cloudflare’s GLM-5.3 incident?
Cloudflare said 155 responses from its hosted Workers AI endpoint contained data from other customers’ requests between August 27 and September 9, 2026. The issue affected prompts longer than 681,280 tokens.
Was the GLM-5.3 model itself responsible?
Cloudflare attributed the incident to a mismatch in its memory-pool configuration and a bug in the SGLang inference engine handling rejected requests in a split processing setup. The source report says the model itself did nothing wrong.
Did Cloudflare report evidence of an attack?
No. Cloudflare said it found no evidence of deliberate exploitation and described the requests as consistent with ordinary long-context use. That is the company’s assessment, not proof that no recipient saw or retained exposed text.
Why is Jump Crypto charging 1 SOL per report?
Jump’s contest received 809 reports that it said amounted to 127 unique findings, with the company believing AI agents found or drafted nearly all of them. Its new platform’s 1 SOL fee is intended to discourage low-quality submission volume; its effects on valid reports remain unknown.
Source: ThorstenMeyerAI.com
