🔍 Read the full analysis: Why AI Spam Is Drowning Out Security Bug Reports on ThorstenMeyerAI.com
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
Cloudflare says its hosted GLM-5.3 service returned 155 responses containing other customers’ request data between Aug. 27 and Sept. 9, 2026. Separately, Jump Crypto says AI agents likely found or wrote nearly all reports submitted to a 2026 Firedancer audit contest, adding to concerns that automated submissions are overwhelming human review.
Cloudflare disclosed that its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests over a two-week period, while a separate security audit contest drew hundreds of reports that organizers believe were produced or found with AI. Together, the cases show a growing operational tension: AI can expose bugs and help identify them, but the volume of machine-generated reports can make it harder for security teams to find the credible issues that need attention.
In an incident report published Oct. 26, Cloudflare said the leak affected its Workers AI hosting of GLM-5.3 from Aug. 27 through Sept. 9. The company attributed it to a configuration mismatch and a bug in the open-source inference engine SGLang. It said only prompts longer than 681,280 tokens could trigger the issue, and that it found no evidence of deliberate exploitation.
Cloudflare said researcher Gadi Evron of Knostic reported the problem through its HackerOne program on Sept. 8. The company declared an incident the next day and took the model offline 38 minutes later, according to its timeline. It restored a fixed version that evening. The report says the 155 responses occurred across 14 days; after removing the company’s tests and the researcher’s activity, Cloudflare said the remaining requests appeared consistent with ordinary long-context use.
In a separate example of the reporting burden, Jump Crypto’s $1 million Firedancer audit contest received 809 submissions from 162 researchers, which were reduced to 127 unique findings. Jump believes AI agents found or wrote nearly all of them, according to the source material. Its new bounty platform requires researchers to spend 1 SOL per report, about $100 according to CoinDesk, in an effort to discourage low-value submissions. The contest figures do not by themselves establish how many reports were fully AI-generated or how many were useful.
Infographic 01 · Cross-request KV cache exposure
How a long prompt read someone else's data.
A memory pool smaller than the advertised context window, plus an engine bug that let rejected requests through, made one hosted model attend over other customers' leftover pages.
The mismatch
tokens; Cloudflare knew before launch and expected an error
Only prompts longer than 681,280 tokens could reach the faulty path.
The eight pages
Cloudflare’s own example of one over-long request
written by this requeststill holding earlier users’ prompts and replies
- Decode reserves 8 pages for the long prompt.
- Prefill rejects it and swaps in a one-token placeholder…
- …but the rejected request still passes the handoff checks.
- Prefill writes one page; decode reads all eight.
- The client gets HTTP 200 and a coherent reply, partly built on someone else’s data.
Why pages hold old data
speed trade-off
- GPU memory is a shared pool of fixed-size pages
- Pages are not zeroed between requests; the next one overwrites
- Bookkeeping is the only wall between customers
The fix
9 Sep, 19:40 UTC
- Pool resized so every valid prompt fits
- Engine retires rejected requests before any memory transfer
- Upstream: SGLang v0.5.20 to v0.5.22; operators should run v0.5.22+
Still open
not in the report
- Whether and how affected customers were notified
- How many customers’ requests contributed the leaked data
- What kind of data it was
Sources: Cloudflare incident report (26 Oct 2026); SGLang/LMSYS (26 Oct 2026). Figures and the no-exploitation finding are Cloudflare’s own.
Powered by Thorsten Meyer AI
When Bug Reports Outnumber Reviewers
Security programs depend on people being able to separate a reproducible vulnerability from an inaccurate, duplicated or irrelevant report. If AI makes it cheap to produce submissions, the time and expertise needed to triage and verify them do not fall at the same rate. That can consume researchers’ and maintainers’ attention, potentially slowing responses to valid findings.
The Cloudflare incident also illustrates a different side of the same problem: automated systems can operate at a scale where configuration and software faults affect many requests before a person spots the pattern. Cloudflare’s reported leak was limited to a particular long-prompt condition, but the incident involved customer data crossing request boundaries, a serious concern for hosted AI services. The two cases are separate; the source material does not establish that AI-generated reports caused, or were connected to, Cloudflare’s bug.
Organizations are now testing ways to raise the cost of submitting weak reports, including deposits and bans on submission farming. Those measures may reduce volume, but they can also affect legitimate researchers if rules are poorly designed. The core challenge is to keep reporting accessible while directing review capacity toward actionable security findings.
Products Worth Considering
LG 34GX90SA-W 34-inch Ultragear WQHD OLED Curved Gaming Monitor
Samsung 27-Inch Odyssey QD-OLED G8 4K 240Hz Gaming Monitor
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
As an affiliate, we earn on qualifying purchases.
A Growing Cost of AI-Assisted Reporting
The examples come amid other signs of strain in vulnerability reporting. The source material says curl ended its bug bounty program in January 2026, Bugcrowd began banning “submission farming” in March, and HackerOne recorded 46,947 submissions that month. Those figures show activity, but they do not establish a rate of increase because no comparable baseline or measurement window is supplied here.
Jump’s contest results also show why raw submission totals can mislead. Its 809 reports became 127 unique findings after review, meaning the initial count was not the count of distinct issues. The source does not provide a detailed breakdown of valid vulnerabilities, duplicates, false positives or reports authored entirely by people. Jump’s view that AI agents found or wrote nearly every submission should therefore be treated as the organizer’s assessment, not an independently verified tally.
Cloudflare’s incident involved GPU memory used to store a model’s intermediate calculations, known as a key-value cache. The company said its memory pages were not cleared between requests because the next request was expected to overwrite them. A mismatch between the advertised context limit and available memory, combined with an SGLang handling bug in Cloudflare’s split processing setup, allowed some rejected requests to proceed in a way that exposed stale data. Cloudflare said it had not validated model output and coherence during its long-context tests.
““we only validated HTTP response codes and engine performance at long contexts, without validating model output and coherence.””
— Cloudflare
What the Reports Do Not Establish
Cloudflare’s report, as summarized in the source material, does not say how affected customers were notified, how many distinct customers received exposed content, or what kinds of data appeared in the 155 responses. It also does not provide evidence that any customer acted on another customer’s text. Cloudflare said it found no sign of deliberate exploitation, but that statement is the company’s assessment of the incident.
It remains unclear how much of Jump’s contest activity was generated by AI, how the organizer reached its estimate, and how many of the 127 unique findings were valid vulnerabilities. The source also does not report whether the new 1 SOL deposit has reduced low-quality submissions or affected participation by legitimate researchers. The contest and Cloudflare incident are separate developments, not evidence of a single coordinated trend or cause.
Testing Fixes and Reporting Rules
Cloudflare says it restored a fixed version of GLM-5.3 on the evening of Sept. 9 after taking the model offline. The incident report describes the immediate response, but the supplied material does not identify a further public milestone or give a detailed customer-notification account. Follow-up information from Cloudflare could clarify the scope of exposure and changes to its testing and memory-handling checks.
For AI-assisted vulnerability reporting, the next signal will be whether programs such as Jump’s can reduce unhelpful volume without screening out valid discoveries. Security platforms and maintainers will need to report more than submission totals: review time, confirmed findings, duplicate rates and false positives would help show whether new rules improve triage. Those outcomes remain to be measured in the examples described here.
Key Questions
What happened in the Cloudflare incident?
Cloudflare said its hosted GLM-5.3 model returned 155 responses containing data from other customers’ requests between Aug. 27 and Sept. 9, 2026. The company attributed the issue to a configuration mismatch and a bug in SGLang.
Did Cloudflare say the leak was deliberately exploited?
No. Cloudflare said it found no evidence of deliberate exploitation and described the remaining requests as consistent with ordinary long-context use. That is the company’s assessment based on its investigation.
Why are AI-generated bug reports a concern?
AI can make it easier to submit reports, but each report still needs human review to confirm whether it describes a real, distinct vulnerability. A high volume of weak or duplicate submissions can use up time needed to investigate valid findings.
How many unique findings came from Jump Crypto’s contest?
The contest received 809 reports, which Jump’s review reduced to 127 unique findings. The supplied material does not give a full breakdown of which findings were valid or how many submissions were written entirely by AI.
Source: ThorstenMeyerAI.com
