Cloudflare's chief executive tells analysts nearly every major frontier AI lab notifies Cloudflare of flaws before disclosure, and that "the worst of it is not over"
On Cloudflare's third-quarter call Matthew Prince said the company has partnered with "nearly every major frontier AI lab and security company searching for flaws in existing software", which notify it through a trusted-reporter process so it can put protections in place for all customers before public disclosure. He said six of "the worst internet security bugs of all time" had been announced in fewer than 14 days, without naming them.
Cloudflare says a KV-cache bug put other customers' data into 155 responses from its hosted GLM-5.3 model
Cloudflare says that "Between August 27 and September 9, a small number of customers using the GLM 5.3 Workers AI model received responses that contained data from other customers' requests" - 155 responses in all, every one to a prompt longer than 681,280 tokens - from a bug in how the SGLang inference server handled over-length requests. It was reported by Gadi Evron of Knostic; Cloudflare fixed its configuration and tells operators to update SGLang to v0.5.22 or later.
A malicious Custom GPT hosted on chatgpt.com walked users into installing a remote access trojan
Huntress researchers Mark O'Halloran and Jonathan Semon describe a Custom GPT named “Plus 5.6,” hosted on chatgpt.com, that sent users to a page on Google Sites presenting as a Cloudflare CAPTCHA check and running a ClickFix lure telling them to paste a command into their terminal, starting an eight-stage chain that sideloaded a remote access trojan through the legitimately signed Canon binary COTFileReadApp.exe and Stardock's DeElevate64.exe. They write that “the Huntress SOC has responded to at least 40 incidents stemming from the specific Google Sites domain involved in this attack, and confirmed that two of these incidents came through a Custom GPT instance.” Huntress says it “reached out to OpenAI regarding this specific Custom GPT, and it was taken down as of September 25; however, on September 27 Huntress researchers discovered a new Custom GPT linked to the same campaign.” The post assigns no CVE.
NVIDIA puts agent policy enforcement on a separate chip from the agent
NVIDIA published a reference design it calls the Open Agent Safety Platform, pairing OpenShell — runtime software that, in its description, "runs agents in isolated environments and enforces policies governing access to files, networks, processes and other resources" — with Sentry, which monitors agent activity and enforces access policy from BlueField-4 data processing units, watching independently of the agent and able to quarantine and stop one that crosses its boundary. Perplexity's sandbox red team, published days earlier, lists NVIDIA OpenShell and Cloudflare Sandbox as the two of ten platforms tested that resisted both network-bypass techniques.
The National Cyber Director's office and Texas launch a six-month cyber pilot for water utilities
Project Watershed 250 is a six-month pilot run by the Office of the National Cyber Director with Texas Cyber Command, offering water and wastewater utilities red-team testing of current defenses, system hardening with private-sector tools, and AI tooling for utility cyber defenders. Twelve companies are named: Parsons, Microsoft, Fortinet, Google Cloud, Palo Alto Networks, Amazon Web Services, Reflection AI, Cloudflare, Zscaler, Forescout, Abnormal AI and Dragos. No number of participating utilities and no dollar figure is stated.
OpenAI leads more than 100 companies in an open letter calling for collective AI cyber defense
OpenAI published an open letter, co-signed by more than 100 organizations including Anthropic, Google, Microsoft, AWS, Oracle, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks and Hugging Face, calling for collective action to defend against sustained AI-enabled attacks. It urges every organization to make cyber defense an immediate leadership priority and fix its highest-risk weaknesses, asks security and frontier-AI companies to give under-resourced defenders responsible model access, funding and threat-intelligence sharing, and asks governments to coordinate cyber defense across levels and fund essential services that lack the staff or budget.
Cloudflare reports a Spectre attack on Workers leaking at 12 bits per second, about 360 times faster than its 2021 result
Cloudflare and academic co-authors report leaking up to 12 bits per second at over 99% accuracy against production Workers, against 120 bits per hour for the 2021 attack, and demonstrate reading isolate heap base addresses, arbitrary 64-bit memory through speculative type confusion, and a JSON web token bit by bit from a victim Worker. Co-location was achieved with a plain fetch() to the victim and timing came from a WebSocket to an external high-resolution timestamp server; Cloudflare says the attack is already mitigated in production and that it has seen no indicators of active exploitation over the last three years.
Poisoned observability logs drive AI coding agents, with a sandbox escape patched before disclosure
Tenet Security reports that error and observability data from services such as Sentry, Cloudflare and Datadog can act as an indirect prompt-injection channel into AI coding agents, claiming a 90% success rate against Claude Code running Sonnet 4.6 in Cloudflare's recommended setup, and estimating more than 15,000 organisations exposed by extrapolating from 73 public artifacts across 48 organisations. Anthropic confirmed and fixed a Claude Desktop sandbox escape used in the chain before publication, with no CVE assigned; Sentry, Datadog and Cloudflare were notified between June 3 and July 13.
NVIDIA, Microsoft, IBM, Cisco and Cloudflare launch the Open Secure AI Alliance
Thirty-seven inaugural partners — including NVIDIA, Microsoft, Adobe, Cisco, Cloudflare, Databricks, Hugging Face, IBM, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP and Snowflake, with the Linux Foundation among them — launched an alliance to share open technology for securing software and agents, contributing working code rather than recommendations: NVIDIA's NOOA agent-harness research, HPE on SPIFFE/SPIRE agent identity, Hugging Face's Safetensors, IBM and Red Hat's signed-patch supply-chain tooling, and Microsoft's MDASH scanning harness. Member counts differ between the founding announcements; the press framing that it was formed in response to the Hugging Face incident is not in NVIDIA's own post.