An attacker exploited a remote code execution vulnerability in SGLang, an open-source engine that runs AI models, to access internal systems at NEAR AI. The company disclosed on November 9 that the intruder downloaded account details for approximately 100 users and retrieved data from 18 older AI agents. This incident exposes a critical flaw in how the business handles its privacy promises, as the breach occurred within infrastructure designed to protect user data from server operators.
The Scope of the Compromise
The intrusion began when the attacker executed commands on one inference server and moved to other parts of NEAR AI’s infrastructure. Investigators traced the path to an internal system connected to Private Chat, a feature the company had already retired. From there, the attacker downloaded names and email addresses for roughly 100 users, along with subscription plan and account balance information for some of them. The threat did not stop at user records; the intruder also accessed 18 agents on a legacy deployment of NEAR AI Agents. These agents were not running inside NEAR AI’s confidential computing environment, which is designed to shield information from the company operating the servers. Consequently, the attacker retrieved their chat histories, settings, and logs without any hardware isolation protecting the data.
Logs from the compromised server also exposed NEAR AI Cloud API keys belonging to two customers. These keys function like digital credentials that applications use to access cloud services, and NEAR AI says it has revoked both, but did not say whether the attacker used them. On November 8, the attacker could have observed user requests being processed on the compromised server, including those in confidential mode. However, NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed. The confirmed theft involved account records and legacy agent data, while exposure of live confidential requests remains a possibility identified by the investigation.
Response and Structural Weaknesses
NEAR AI acknowledged that hardware isolation does not guarantee that the software inside the protected environment is safe. "It does not protect against a vulnerability in the software running inside the environment," the project stated, explaining that the SGLang flaw let the attacker run code where confidential requests were being processed. This admission is particularly awkward for a business selling privacy as a core feature, especially after announcing in October that Brave’s Leo browser assistant was using its confidential inference infrastructure. SGLang had already attracted scrutiny from security researchers; in July, Carnegie Mellon University’s CERT Coordination Center documented six vulnerabilities in the project, including bugs that could let attackers execute commands or expose credentials depending on how servers were configured. NEAR AI did not identify the specific SGLang flaw exploited in this incident, so there is no basis to link the breach to any of those earlier disclosures. It reported the vulnerability to SGLang’s developers and quickly fixed the issues.
"On detection, we revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers," the project said. The company completed the rotation of all remaining credentials and a full forensic review. NEAR AI notified users whose account details or agents it confirmed were accessed and will make any regulatory notifications that are required. It also warned users to be wary of unsolicited messages referring to their Near AI accounts or balances, and contacted the owners of all 18 affected agents individually. Access to NEAR AI Cloud, which was paused during the investigation, has been restored.
