NEAR AI breach: SGLang flaw let attacker read user account details and live requests

NEAR AI, the AI product and infrastructure arm of the NEAR Protocol ecosystem, says it has contained a security breach in which an attacker exploited a remote code execution vulnerability in SGLang — the open-source inference engine running on its servers — to reach user data. The account comes from the company's own security incident report, published Monday, as reported by The Block.

By NEAR AI's account, the attacker gained code execution on a single inference server and used it to reach an internal system behind a previously deprecated Private Chat feature. From there, the attacker downloaded account details — email addresses, names, and in some cases plan and balance information — for roughly 100 users. The attacker also accessed 18 agents on a legacy NEAR AI Agents deployment that was not running inside the company's confidential computing environment, obtaining their chat history, settings and logs. Two Cloud customers had API keys exposed in logs; NEAR AI says those keys have since been revoked.

The company says that on Nov. 8 the attacker could have observed user requests being processed on the compromised server, including requests submitted in confidential mode. NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed.

NEAR AI says it has closed the access, replaced affected credentials, patched the vulnerability across all inference servers, revoked active sessions and administrative credentials, rotated agent tokens, and taken Private Chat offline. Access to NEAR AI Cloud, paused during the investigation, has been restored. The company says it has contacted the affected users and the 18 agent owners individually.

Key facts

• RCE vulnerability in the open-source SGLang inference engine, exploited on one inference server (NEAR AI incident report, via The Block).
• Account details for ~100 users downloaded, including emails, names, and in some cases plan/balance data (NEAR AI).
• 18 agents on a legacy, non-confidential deployment accessed — chat history, settings, logs (NEAR AI).
• Two Cloud customers' API keys exposed in logs; since revoked (NEAR AI).
• On Nov. 8, attacker could observe in-process requests, including confidential-mode ones; no indication stored Private Chat data or uploaded files were accessed (NEAR AI).

The real-world read

The uncomfortable detail is in NEAR AI's own words: "Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment." The product's selling point — confidential, enclave-protected inference — did not stop an attacker who got code running inside the enclave, and could expose even confidential-mode requests mid-processing. Note also where the damage landed: a "previously deprecated" Private Chat feature and a "legacy" deployment that sat outside the confidential environment — retired systems still holding live user data.

One caveat on scope: the figures here — ~100 users, the "no indication" that chats or files were read — all come from NEAR AI, the affected party, and have not been independently verified.

Opinion, and whose

NEAR AI argues its public, verifiable inference stack is a strength, saying its code and configurations "remain public so that anyone can verify what is running." That's the company's framing; the breach is recent and no third-party review has been reported.

Sources

• The Block (secondary reporting), "NEAR AI says SGLang vulnerability exposed user account details in security breach," Nov. 10, 2026 — summarizing NEAR AI's primary incident report; direct quotes attributed to NEAR AI.

Not financial advice.