NEAR AI Breached Through an SGLang Remote Code Execution Flaw: About 100 Users and 18 Legacy Agents Exposed, and Confidential Mode Didn't Stop It
NEAR AI says an attacker exploited an unidentified remote code execution bug in the open-source SGLang inference engine to reach user account data, legacy agent logs and two customer API keys, showing that enclaves do not protect against vulnerable code inside them.
NEAR AI, the AI arm of the NEAR ecosystem that markets private, confidential-computing AI inference, has disclosed a breach. An attacker exploited a remote code execution flaw in the open-source SGLang inference engine on one of its servers. The intrusion on 8 November 2026 exposed account details for about 100 users and data from 18 legacy AI agents. It also exposed API keys for two cloud customers.
NEAR AI's report also makes an important point about confidential computing: a trusted execution environment does not protect against bugs in the software running inside it.
What Happened
According to NEAR AI's incident report, published on 9 November and updated on 10 November, the attacker went through these steps:
- Exploited an RCE vulnerability in SGLang, a widely used open-source serving engine for large language models, on one inference server.
- Used that code execution to reach an internal system connected to NEAR AI's Private Chat service, which had already been discontinued.
- Downloaded user account data and data from older agent deployments.
NEAR AI has not identified the specific SGLang vulnerability. It has not published a CVE identifier or the affected SGLang version, and at the time of writing the SGLang project had published no security advisory about it. It is therefore unclear whether this was a new zero-day, a known but unpatched bug, or an unsafe configuration.
What Was Exposed
NEAR AI says the exposed data includes:
- names and email addresses of about 100 users, plus subscription plan and account balance details in some cases
- conversation histories, settings and logs from 18 legacy agents on an older NEAR AI Agents deployment that ran outside the confidential computing environment
- API keys for two NEAR AI Cloud customers, which appeared in logs and have since been revoked
The company says it found no evidence of access to stored Private Chat conversations or uploaded files. NEAR Protocol and other NEAR services were not affected.
There is one significant caveat. NEAR AI says requests processed on the compromised server on 8 November, including requests sent in confidential mode, could have been observed by the attacker. It has not said how many requests that involves.
The Confidential-Computing Lesson
NEAR AI promotes private inference that runs inside hardware-isolated enclaves. Its own statement explains the limit: "Confidential computing protects data from the operator and the host." It does not protect against vulnerabilities in software running inside the environment.
In other words, an enclave keeps the cloud provider and the platform operator out. But if the inference engine inside the enclave has an RCE bug, an attacker who exploits it runs code where the plaintext prompts and responses live. Attestation proves that the expected code is running. It does not prove that the code is free of bugs.
NEAR AI says it will now apply "the same security rigor" to inference software and surrounding services as it applies to the enclave itself. It notes that its confidential inference code, dependencies and deployment configurations remain public for verification.
Patch Status and Response
NEAR AI says it has:
- blocked the attacker's access and applied the SGLang patch to all inference servers
- invalidated all active sessions and administrator credentials
- replaced affected credentials and rotated all agent tokens
- revoked the two exposed cloud API keys
- taken Private Chat offline
- completed a forensic review and the remaining credential rotations
- restored NEAR AI Cloud, which had been paused during the investigation
Affected users and agent owners were contacted individually. The company says: "If you haven't heard from us, no action is needed."
Who Else Should Pay Attention
SGLang is a popular high-performance serving framework used by AI startups, research labs and companies that self-host open-weight models. Until the specific flaw is identified, anyone running it should assume their deployment may be exposed.
- Keep SGLang on the latest release and follow the project's release notes and security advisories.
- Never expose SGLang's HTTP or RPC endpoints directly to the internet. Put them behind an authenticated gateway, and keep internal and worker ports on private networks.
- Run inference servers with minimal privileges and network segmentation, so a compromised server cannot reach databases, admin systems or legacy services.
- Keep secrets and API keys out of logs, and redact request data that does not need to be logged.
- Retire discontinued services completely, including their back-end databases and connections. In this case the attacker reached data through a product that had already been shut down.
Why It Matters
AI inference stacks are becoming a new attack surface. Serving engines are complex, fast-moving codebases that parse untrusted input from every user. They often run with access to GPUs, model weights and internal systems.
The NEAR AI breach is small in numbers, but it shows two growing risks. First, open-source inference engines can be the way in. Second, privacy guarantees built on confidential computing are only as strong as the application code inside the enclave. Any company selling "private AI" should be clear about where that guarantee ends.
