NEAR AI Breach Exposes Data of About 100 Users Through SGLang Vulnerability

Key Facts

NEAR AI said in a report published on November 9 that an attacker exploited a remote code execution vulnerability in the open-source inference engine SGLang, allowing the attacker to execute code on one inference server and access part of the infrastructure. The company said its investigation confirmed that data from about 100 user accounts had been downloaded, including email addresses and names, as well as plan and balance information for some accounts. It said the access reached an internal system behind the previously discontinued Private Chat service. The attacker could also monitor user requests processed by the compromised server on November 8, including requests running in confidential mode, the company said. The incident highlights the impact of vulnerabilities in software that powers AI services, even when those services use environments designed to protect data.

The access included 18 agents from an older deployment of NEAR AI Agents, which did not run in the confidential computing environment known as a TEE. The company said data retrieved from the agents included conversation histories, settings and operational logs. In another part of the incident, NEAR AI confirmed that API keys belonging to two NEAR AI Cloud customers had appeared in logs, adding that it had revoked both keys. It said some of the downloaded account data included plan and balance information, prompting it to urge users to be cautious with unsolicited messages referring to their accounts or balances. The company said it had notified users whose account or agent data the attacker was confirmed to have accessed.

The company distinguished between requests being processed and stored data, saying it found no evidence of access to stored Private Chat conversations or files uploaded by users. But it said the attacker could have viewed requests while they were being processed on the server it accessed, including requests running in confidential mode. NEAR AI explained that confidential computing protects data from the service operator and host, but does not prevent exploitation of a vulnerability in software running inside the environment. The SGLang flaw enabled access to requests during processing despite those protections, the company said. That means protections for stored data and against access by the operator do not, on their own, address execution vulnerabilities in software handling data inside the environment.

NEAR AI said it revoked active sessions and administrative credentials, replaced agent tokens, shut down the Private Chat service and deployed a fix for the SGLang vulnerability across all inference servers. It added that it had closed unauthorized access, replaced affected credentials and completed rotation of the remaining credentials and the forensic review. Access to NEAR AI Cloud was restored after those measures and the vulnerability fix, it said. The company also said it had notified the SGLang project of the vulnerability and would apply the same level of security analysis to inference software and services surrounding the enclave environment. It said it would make required regulatory notifications, without specifying a timeline in its report.

The incident comes amid previous security disclosures about separate vulnerabilities in the SGLang project, though sources did not link those disclosures to the flaw exploited against NEAR AI. In March 2026, the CERT Coordination Center documented two vulnerabilities related to unsafe deserialization and said they were addressed in version 0.5.10. In a note published on July 16, the center discussed another vulnerability that allows remote code execution when the expert-parallel backup system is enabled and the service is exposed to the network; it said no patch was available at the time. The center then reported six vulnerabilities in the project on July 30, including remote code execution, credential leaks and model-weight extraction. In a separate incident, Cloudflare said cross-request leakage led it to make the GLM 5.3 model private on September 9, then restore it after rebuilding the deployment and adding a fix; it later advised SGLang operators to upgrade to version 0.5.22 or later.