Product Manager Intern

The AI spam flood behind A difficult bug hunting search. Cloudflare says a hosted AI model returned 155 responses containing other customers' data. A separate audit highlights the growing burden of AI-generated bug reports. Up next. Published on 27 October 2026 AI This post was created with the assistance of artificial intelligence (AI). Buying for a business? Offer from Amazon Get business pricing on monitors, keyboards and dev gear * Business-only prices and quantity discounts * Tax-exempt purchasing * Multiple users, one account, clear invoices As an affiliate, EarnQA, Inc. earn on qualifying purchases. Cloudflare reported that its hosted GLM-5.3 model returned 155 responses containing data from other customers' requests between August 27 and September 9, 2026. In a separate security-audit example, Jump Crypto says AI agents likely found or wrote nearly all reports submitted to a Firedancer contest, leaving reviewers to sort 809 submissions into 127 unique findings. Cloudflare disclosed October 26 that its hosted GLM-5.3 model returned 155 responses containing data from other customers' requests over a 14-day period. A separate Jump Crypto audit contest offers a contrasting security problem: the company received 809 submissions that it says were reduced to 127 unique findings, with AI agents likely responsible for nearly all the reports. Together, the cases show how AI can create both security risks in deployed services and more work for the people reviewing bug reports. Cloudflare traced the leak, which ran from August 27 to September 9, to a mismatch in its configuration combined with a bug in the open-source inference engine SGLang. The affected endpoint was its hosted @cf/zai-org/glm-5.3 model on Workers AI. According to Cloudflare, only prompts longer than 681,280 tokens could trigger the issue, despite the service advertising a context window of 1,048,576 tokens. Discover more Audit Quality Try Cloud Tools Try Dev Tools The incident involved the model's key-value cache, a store of intermediate data used to generate responses. Cloudflare said cache pages were not cleared between requests, a practice it described as common and useful for performance. When a too-long prompt was rejected in one part of its split inference setup, a queue in another part checked whether the request had finished but not whether it had been rejected. That allowed decoding to read cache pages that still contained data from other requests. Cloudflare says the affected responses returned HTTP 200 and could appear coherent. Security researcher Gadi Evron of Knostic reported the issue through HackerOne on September 8. Cloudflare says it took the model offline 38 minutes after declaring an incident and restored a fixed version later that evening. It found no evidence of deliberate exploitation, and says the affected requests appeared consistent in timing and volume with ordinary long-context use. Separately, Jump Crypto's $1 million Firedancer audit contest drew reports from 162 researchers. Jump says those 809 reports amounted to 127 unique findings and believes AI agents found or wrote nearly every submission. At a glance report When: Cloudflare published its incident repor... The development A Cloudflare incident report and a Jump Crypto audit contest illustrate two different security effects of AI: a customer-data leak in hosted inference and a surge of reports that are costly to review. Thorsten Meyer AI Cloudflare Workers AI · GLM-5.3 Infographic 01 · Cross-request KV cache exposure How a long prompt read someone else's data. A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages. 155 responses that contained other customers' data 14 days exposure window, 27 Aug to 9 Sep 2026 38 min from declaring the incident to taking the model offline none evidence of deliberate exploitation, per Cloudflare The mismatch. tokens; Cloudflare knew before launch and expected an error * Context windowadvertised1,048,576 * KV pool before the fixprefill GPUs681,280 * KV pool after the fixabout twice the window~2.04 M Only prompts longer than 681,280 tokens could reach the faulty path. The eight pages. Cloudflare's own example of one over-long request P0 written now P1 left over P2 left over P3 left over P4 left over P5 left over P6 left over P7 left over * Decode reserves 8 pages for the long prompt. * Prefill rejects it and swaps in a one-token placeholder... * ...but the rejected request still passes the handoff checks. * Prefill writes one page; decode reads all eight. * The client gets HTTP 200 and a coherent reply, partly built on someone else's data. Why pages hold old data. speed trade-off * GPU memory is a shared pool of fixed-size pages * Pages are not zeroed between requests; the next one overwrites * Bookkeeping is the only wall between customers The fix. 9 Sep, 19:40 UTC * Pool resized so every valid prompt fits * Engine retires rejected requests before any memory transfer * Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+ Still open. not in the report * Whether and how affected customers were notified * How many customers' requests contributed the leaked data * What kind of data it was Two costs of ai-assisted security. The Cloudflare incident matters because it involved customer data crossing request boundaries in a hosted AI service. A customer submitting an unusually long prompt could receive text associated with another customer's request. Cloudflare's report gives a count of affected responses and a technical explanation, but does not state how many customers were affected or describe how they were notified. The audit example points to a different pressure on security teams: generating bug reports has become cheaper, but validating, deduplicating and investigating them still takes human time. Jump's contest figures do not establish that AI-generated reports were invalid; the company's reported 127 unique findings came from 809 submissions. But the gap between submissions and unique findings shows why raw report volume is a poor measure of useful security work. For service operators, the leak underscores the need to test what a model returns - not just whether an inference request completes successfully. For bounty programs and researchers, the challenge is maintaining useful disclosure channels when automated tools can produce reports at scale.

How A KV cache leak can put an AI answer in the wrong session. Cloudflare says its hosted GLM-5.3 model returned 155 responses containing other customers' data after a configuration mismatch and SGLang bug. Up next. Published on 27 October 2026 AI This post was created with the assistance of artificial intelligence (AI). Before you order Offer from Amazon Get hardware and tech essentials delivered free with Prime * Fast, free delivery on millions of items * Prime Video, Amazon Music and more included * Member-only deals all year As an affiliate, One2crypto earn on qualifying purchases. Cloudflare's incident report says its hosted GLM-5.3 model returned 155 responses containing text from other customers' requests between Aug. 27 and Sept. 9, 2026. The issue required prompts longer than 681,280 tokens and stemmed from a Cloudflare configuration mismatch combined with a bug in the SGLang inference engine. Cloudflare says it found no evidence of deliberate exploitation; its report does not explain how affected customers were notified. Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing text from other customers' requests during a 14-day period, after a configuration mismatch and a bug in the SGLang inference engine caused parts of GPU memory to be read across sessions. The company says the issue affected only prompts longer than 681,280 tokens and that it found no evidence of deliberate exploitation. In an incident report published Oct. 26, Cloudflare said the affected responses occurred between Aug. 27 and Sept. 9. Security researcher Gadi Evron of Knostic reported the issue through Cloudflare's HackerOne program on Sept. 8, saying very long prompts to the hosted endpoint sometimes returned text belonging to other users' sessions. Cloudflare counted 155 affected responses after excluding its own tests and the researcher's requests. The incident required two faults to coincide. Cloudflare configured the model with a 1,048,576-token context window, but the memory pool used to hold the prompt's KV cache could store only 681,280 tokens. The company expected oversized requests to produce an error. A bug in SGLang, however, let rejected requests continue through parts of Cloudflare's split prefill-and-decode system rather than stopping them. Cloudflare said the decode stage had reserved memory pages for the full prompt, while the prefill stage wrote only a one-token placeholder. The remaining pages could still contain other customers' prompts and partial generations. As a result, some responses were returned with an HTTP 200 status instead of an error. Cloudflare said it took the model offline 38 minutes after declaring an incident and restored a fixed version that evening. At a glance report When: Incident ran Aug. 27-Sept. 9, 2026; Clo... The development Cloudflare published an incident report describing a cross-customer data leak in its hosted GLM-5.3 service caused by a KV cache configuration mismatch and an SGLang bug. Crypto market snapshot Fear & Greed Index 48/100 - Neutral Bitcoin BTC $79,860 0.5% Ethereum ETH $2,316 0.5% Tether USDT $0.9987 0.1% BNB BNB $738.3 0.0% XRP XRP $1.3 1.1% USDC USDC $0.9994 0.0% Solana SOL $100.12 1.2% TRON TRX $0.3273 1.0% Live data · CoinGecko · alternative.me (24h change) Thorsten Meyer AI Cloudflare Workers AI · GLM-5.3 Infographic 01 · Cross-request KV cache exposure How a long prompt read someone else's data. A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages. 155 responses that contained other customers' data 14 days exposure window, 27 Aug to 9 Sep 2026 38 min from declaring the incident to taking the model offline none evidence of deliberate exploitation, per Cloudflare The mismatch. tokens; Cloudflare knew before launch and expected an error * Context windowadvertised1,048,576 * KV pool before the fixprefill GPUs681,280 * KV pool after the fixabout twice the window~2.04 M Only prompts longer than 681,280 tokens could reach the faulty path. The eight pages. Cloudflare's own example of one over-long request P0 written now P1 left over P2 left over P3 left over P4 left over P5 left over P6 left over P7 left over * Decode reserves 8 pages for the long prompt. * Prefill rejects it and swaps in a one-token placeholder... * ...but the rejected request still passes the handoff checks. * Prefill writes one page; decode reads all eight. * The client gets HTTP 200 and a coherent reply, partly built on someone else's data. Why pages hold old data. speed trade-off * GPU memory is a shared pool of fixed-size pages * Pages are not zeroed between requests; the next one overwrites * Bookkeeping is the only wall between customers The fix. 9 Sep, 19:40 UTC * Pool resized so every valid prompt fits * Engine retires rejected requests before any memory transfer * Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+ Still open. not in the report * Whether and how affected customers were notified * How many customers' requests contributed the leaked data * What kind of data it was How shared GPU memory crossed sessions. The incident shows how a failure in inference-engine bookkeeping can expose information even when the underlying AI model is not itself at fault. KV cache data is temporary working memory created as a model processes a prompt. In this setup, memory pages were reused between requests without being cleared; the system relied on software tracking to prevent one request from reading pages associated with another. For customers, the concern is that an answer can appear coherent and arrive successfully while including material from a different session. Cloudflare said the affected responses were associated with exceptionally long prompts, which narrows the reported condition, but the report does not establish what specific customer information appeared in each response or whether recipients recognized the material as foreign. The episode also highlights the need to test output correctness and isolation, not just response codes and system performance. The disclosure comes alongside a wider challenge for security programs: AI tools can generate large volumes of bug reports, making it harder to identify valid findings. The source account cites Jump Crypto's Firedancer audit contest, where 809 reports from 162 researchers were reduced to 127 unique findings; Jump believes AI agents found or wrote nearly every submission. That separate example does not establish a connection to Cloudflare's incident, but it illustrates the pressure on teams to review security findings while also investigating vulnerabilities.