NEAR AI breach used SGLang flaw to reach confidential AI requests

NEAR AI, which runs the NEAR AI Cloud inference service, says an intruder broke into its infrastructure through a remote code execution vulnerability in SGLang, a widely used open-source engine for serving large language models. In its incident report, the company says the flaw gave the intruder code execution on one inference server and, from there, access to other parts of its infrastructure.

NEAR AI first disclosed unauthorised access to its internal systems at 23:14 UTC on Monday and paused NEAR AI Cloud inference. It brought the service back about four hours later, after fixing the flaw on every server and replacing affected credentials. Its latest update dates the intrusion to Sunday, November 8. NEAR Protocol and other NEAR services were not affected, the company says.

What was reached

From the compromised server, the intruder reached an internal system behind NEAR AI's retired Private Chat product and downloaded account details for about 100 users: email addresses, names and, for some, plan and balance information. They also got into 18 agents on a legacy deployment of NEAR AI Agents that did not run in the company's confidential computing environment, taking their chat history, settings and logs. Two Cloud customers had API keys exposed in logs; those keys have been revoked. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.

On November 8 the intruder could also have seen user requests being processed on the compromised server, including requests running in NEAR AI's confidential mode, which it markets as protected inside hardware-isolated secure enclaves. The company says confidential computing protects data from the operator and the host, but not from a flaw in the software running inside the enclave, which is what SGLang is.

The SGLang flaw

NEAR AI says it has reported the vulnerability to the SGLang project. The project's GitHub security advisories list nothing for it yet, no CVE has been published, and the newest SGLang release, v0.5.23, came out on November 2, before the intrusion. NEAR AI has not described the flaw or said which SGLang versions are affected, so other operators running SGLang have no fix to apply yet.

What NEAR AI did

The company revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, rotated its remaining credentials and completed a forensic review. It has contacted affected users and agent owners from security@near.ai and warns users to treat unsolicited messages about their account or balance with caution.