EL7.AI
GeneralMediumUpdated×2•Originally published 10 November 2026•Updated 11 November 2026•
4 min read

NEAR AI Breach Exposes Data of About 100 Users and Prompts on an Inference Server

Key Facts

1NEAR AI confirmed the download of account data for about 100 users, including email addresses and names, and plan and balance information for some accounts.
2Access affected 18 agents in an older deployment that did not run in a confidential computing environment.
3API keys for two NEAR AI Cloud customers appeared in the logs, and the company revoked both keys.
4The attacker could view prompts being processed on the compromised server on November 8, including prompts in private mode.

NEAR AI said in a report published on November 9, 2026, that an attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine and ran commands on one inference server before accessing part of the company’s infrastructure. The investigation confirmed the download of account data for about 100 users, including email addresses and names, as well as plan and balance information for some accounts. The company also said that on November 8, the attacker was able to view user prompts as they were processed on the server they accessed, including prompts running in private mode. NEAR AI blocked the unauthorized access, fixed the vulnerability and then restored access to NEAR AI Cloud. The incident puts inference engine security at the center of the risks facing AI services, as a software vulnerability can enable access to data while it is being processed even when other safeguards are in place.

The access also covered 18 agents in an older deployment of NEAR AI Agents that did not run inside the confidential computing environment known as a TEE, according to the company’s report. NEAR AI said data retrieved from those agents included conversation logs, settings and operational logs. In a separate part of the incident, logs revealed API keys belonging to two NEAR AI Cloud customers, and the company confirmed that it revoked both keys. It also warned that the downloaded plan and balance information could make unsolicited messages referring to a user’s account or balance more convincing. The company said it notified users whose account or agent data the attacker was confirmed to have accessed.

The company distinguished between prompts being processed and stored data, saying it found no indication that the attacker accessed stored Private Chat conversations or files uploaded by users. But it said prompts on the compromised server could have been observed as they were processed on November 8, including prompts running in private mode. NEAR AI explained that confidential computing protects data from the service operator and host, but does not prevent exploitation of a vulnerability in software running inside the environment. The company said the SGLang vulnerability enabled access to prompts during processing despite those protections. This highlights the difference between protecting data from access by the operator or host and protecting the software processing that data from exploitation.

NEAR AI said it revoked active sessions and administrative credentials, replaced agent tokens, suspended Private Chat and deployed a fix for the SGLang vulnerability across all inference servers. It added that it completed rotation of the remaining credentials and a full forensic review. According to the report, unauthorized access was blocked and the vulnerability fixed before access to NEAR AI Cloud was restored. The company said it notified the SGLang project about the vulnerability and will apply the same level of security analysis to inference software and services surrounding the enclave environment. It also said it will make the required regulatory notifications, without specifying a date in the report.

The incident comes amid earlier disclosures of separate vulnerabilities in SGLang, though the sources did not link those vulnerabilities to the attack on NEAR AI. On March 12, 2026, CERT/CC documented two vulnerabilities related to unsafe deserialization and said version 0.5.10 addressed them. In a note dated July 16, the center said a vulnerability in the expert-parallel backup system could allow remote code execution when the system was enabled and the service was exposed over a network, noting that no patch was available at the time. On July 30, the center covered six vulnerabilities in the project, including remote code execution, local file reads, credential leaks and model weight extraction, and said patches were unavailable at publication. These disclosures provide a broader security context for inference engines, but do not establish a connection between the earlier vulnerabilities and the exploitation reported by NEAR AI.

In a separate incident, Cloudflare said an isolation issue in the GLM-5.3 model on Workers AI affected the period between August 27 and September 9, 2026, and that 155 responses contained data from requests belonging to other customers. It added that all affected requests exceeded 681,280 tokens in length. The company restored the model on September 9 after deploying a corrected configuration and a patched inference engine. Cloudflare did not link this incident in its disclosure to the NEAR AI attack or the SGLang vulnerability exploited against it. The disclosure adds a separate example of the risk of data leakage between requests in AI model runtime environments.