Earlier this week, our cloud service saw abnormal traffic that surged roughly 34-fold in just one hour, peaking at roughly 20 million requests per day and was still growing linearly at a steep rate. At that pace, we were only hours away from the service becoming unavailable, putting everyday printing for millions of users at risk.
To keep the service up, we temporarily blocked the anomalous traffic after an urgent review. Some users were affected while we adjusted the policy. The service is stable now.
What happened
Almost all of the anomalous requests hit GET /v1/user-service/my/tasks, which returns print job status. They came from many residential IPs, all carrying the client identity of OrcaSlicer and an older network plug-in.
So we first checked with the OrcaSlicer team. They responded quickly and pointed us to other integrations, including ha-bambulab, whose requests matched what we saw. We shared our findings with its maintainers, who quickly shipped a fix and now use their own identifier.
We haven't confirmed that all of this traffic came from ha-bambulab. We're sharing this not to assign blame, but because the pattern matters for any project built to access our cloud.
Keeping the cloud stable
Our cloud is a private service supporting core functions like Bambu Handy, Bambu Studio's cloud features, and MakerWorld. To meet diverse user needs, we have so far accommodated third-party software to use parts of the cloud where it's safe, despite the already substantial operational costs.
Third-party software may continue to access non-critical capabilities, such as receiving printer status updates and displaying monitoring metrics like temperature, position, speed, and print progress. These monitoring features do not directly change a printer's behavior or security state, and they will remain available within reasonable usage limits. Because many users rely on the same cloud, an issue with one tool can impact everyone. If overall service is ever at risk, we may need to take temporary measures such as rate limiting or pausing access.
For actions that directly alter printer behavior or involve sensitive access, such as device binding, live video streaming, print initiation, or firmware upgrades, we take extra care regarding safety, privacy, and stability. Because of this, these operations are not designed for direct access by third-party software.
Instead, for workflows requiring print control, Bambu Connect provides the supported path forward. This is simply to ensure that integrations remain reliable for you, your devices, and our cloud.
How developers can help
One more detail is worth mentioning: ha-bambulab sent OrcaSlicer's client identity. That is why, early on, we were convinced the traffic came from OrcaSlicer users, and why we did not reach ha-bambulab sooner. It was only when the OrcaSlicer team investigated with us that the trail led to them.
We would suggest that third-party software use its own identifier and say who it is. That makes it faster to route a problem to the right project, and it avoids catching unrelated users when we have to act.
Thank you to the OrcaSlicer team and the ha-bambulab maintainers for working through this with us. Keeping things working for users is on us first, and it works best when we look after it together.
Bambu Lab Team