An attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to break into NEAR AI's infrastructure and pull account details for about 100 users along with data from 18 hosted AI agents, the company said in an incident report published Nov. 9. NEAR AI said it has fixed the flaw on all of its inference servers and restored its NEAR AI Cloud service, which it had paused during the investigation.
NEAR AI is the AI product and infrastructure arm of the NEAR Protocol ecosystem, according to The Block. The company said NEAR Protocol and its other services were not affected, crypto.news reported.
How the attacker moved
According to NEAR AI, the vulnerability gave the attacker code execution on one inference server, the machine that runs a model and answers requests. From there the attacker reached an internal system behind Private Chat, a product NEAR AI had already deprecated, and downloaded email addresses and names for about 100 users. For some of those accounts the data included plan and balance information, the company said.
The attacker also reached 18 agents on a legacy deployment of NEAR AI Agents that did not run inside the company's trusted execution environment, or TEE, a hardware-isolated area meant to keep data private even from the operator. For those agents, the data taken included chat history and settings as well as logs. Two NEAR AI Cloud customers had API keys exposed in logs, and those keys have been revoked, the report said.
NEAR AI said it found no indication that stored Private Chat conversations or uploaded files were accessed. It added that on Nov. 8 the attacker could also have observed user requests being processed on the compromised server, including requests running in confidential mode.
Where confidential computing stops
The report is direct about the limits of enclave-based privacy. "Confidential computing protects data from the operator and the host," NEAR AI wrote. "It does not protect against a vulnerability in the software running inside the environment, and that is what happened here."
The company said it would now treat "the inference software and the services around the enclave with the same rigor as the enclave itself" in its security analysis. It said it had reported the vulnerability to the SGLang project. NEAR AI did not publish a CVE number or say which SGLang version it had been running.
SGLang has had remote code execution flaws before. In an advisory, CERT/CC described vulnerabilities tracked as CVE-2026-3059 and CVE-2026-3060, in which SGLang deserialized untrusted data with Python's pickle module over unauthenticated ZeroMQ interfaces when certain features were enabled. CERT/CC said version 0.5.10 addresses them and advised operators not to expose those interfaces to untrusted networks. NEAR AI has not said whether the flaw used against it is one of those issues or a new one.
Response
On detection, NEAR AI said it revoked all active sessions and administrative credentials and replaced every agent token. It also took Private Chat offline. It said it has since completed a full forensic review and the rotation of all remaining credentials.
Affected users were contacted from security@near.ai, and the 18 agent owners were contacted individually, the company said. NEAR AI also told users to treat unsolicited messages referencing their account or balance with caution, and said it would make any required regulatory notifications.
Source: NEAR AI, “Security Incident Report: SGLang Vulnerability”
Additional sources: The Block, “NEAR AI says SGLang vulnerability exposed user account details in security breach”; crypto.news, “NEAR AI fixes SGLang security flaw, restores Cloud service”; CERT/CC, “VU#665416 - SGLang is vulnerable to code execution attacks via unsafe pickle deserialization”
