NEAR AI has confirmed that an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine running on its servers, to break into part of its infrastructure on Sunday, November 8. The company says the attacker downloaded account details for about 100 users, accessed 18 AI agents, and could have seen user requests processed on the compromised server that day, including requests sent in its “confidential mode.”
NEAR AI first disclosed the intrusion on the evening of November 9, when it paused NEAR AI Cloud inference as a precaution. It published a security incident report the same day and said the access had been closed, the flaw fixed and the service restored.
From one inference server to a retired chat product
According to NEAR AI, the attacker used the SGLang vulnerability to run code on one inference server and, from there, reached other parts of its infrastructure. The intruder then got into an internal system behind Private Chat, a product NEAR AI had already deprecated, and downloaded account details for roughly 100 users.
NEAR AI says the downloaded details were:
- Email addresses
- Names
- Plan and balance information, for some accounts
The company says it found no sign that stored Private Chat conversations or uploaded files were accessed.
The attacker also reached 18 agents on a legacy deployment of NEAR AI Agents that was not running inside the company’s confidential computing environment. For those agents, the data taken included chat history, settings and logs. Two NEAR AI Cloud customers had API keys exposed in those logs, and NEAR AI says the keys have been revoked.
Why the secure enclave did not stop it
NEAR AI markets its cloud inference as private because it runs inside hardware-isolated secure enclaves, known as trusted execution environments (TEEs). The company was direct about the limits of that protection in its report.
“Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here,” NEAR AI wrote. Because SGLang runs inside the enclave, the flaw let the attacker run code there and access requests being processed on that server on November 8, including confidential ones.
NEAR AI says it will now apply the same level of security review to the inference software and surrounding services as it does to the enclave itself. It added that the code, dependencies and deployment settings for its confidential inference stack remain public so anyone can check what is running.
What NEAR AI has done so far
After detecting the intrusion, NEAR AI says it:
- Revoked all active sessions and administrative credentials
- Replaced all agent tokens
- Took Private Chat offline
- Deployed a fix for the
SGLangflaw across all inference servers - Rotated all remaining credentials and completed a full forensic review
NEAR AI Cloud came back online late on November 9. The company says NEAR Protocol and other NEAR services were not affected.
Update: On November 8, an attacker used a vulnerability in SGLang, the inference engine we run, to access part of our infrastructure. We’ve closed the access and fixed it.
Affected users have been contacted. If you haven’t heard from us, no action is needed.…
— NEAR AI (@near_ai) November 10, 2026
No public SGLang fix yet
NEAR AI says it reported the vulnerability to the SGLang project. It has not named a CVE or listed which SGLang versions are affected. As of the afternoon of November 10, the project’s GitHub releases showed no new version since v0.5.23 on November 2, and no advisory tied to NEAR AI’s report had been published.
That leaves other teams running SGLang without a public patch or technical details for now. SGLang has had serious remote code execution bugs before. Earlier this year, the project fixed unauthenticated flaws in its ZMQ broker (CVE-2026-3059) and disaggregation module (CVE-2026-3060). NEAR AI has not said whether the flaw used against it is related to either one.
Operators should keep SGLang servers and their internal ports off the public internet, limit what each inference node can reach, and watch for a security release from the project.
What affected users should do
NEAR AI says it has contacted affected users directly from security@near.ai, and the 18 agent owners have been contacted one by one. Users who have not heard from the company do not need to take action. NEAR AI says it will make any required regulatory notifications.
Because names, email addresses and account balances were taken, affected users should be wary of unexpected messages that mention their NEAR AI account or balance. Phishing that uses real account details is a common follow-up to this kind of breach.
Another hit to AI infrastructure
The incident adds to a run of attacks on companies that host or serve AI models. On November 10, BreachNews reported that the Fireworks AI breach had widened to billing data, datasets and partial model weights. Attackers have also gone after AI developer platforms and customer secrets in the hunt for AI API keys.
