Near AI Discloses Security Breach After SGLang Vulnerability Exploited on Inference Servers

Near AI has publicly disclosed a security breach that compromised account information belonging to approximately 100 users and exposed operational data from 18 distinct AI agents. The incident occurred after an unauthorized actor successfully exploited a software vulnerability running on the company’s backend servers, highlighting ongoing security challenges in the fast-evolving artificial intelligence infrastructure sector.

According to a detailed security incident report published by the company on November 9, the attacker leveraged a remote code execution vulnerability embedded within SGLang. SGLang is widely utilized as an open-source serving and inference engine designed to efficiently run large AI models and generate rapid responses to user prompts. By exploiting this specific vulnerability, the malicious actor managed to execute arbitrary commands on an initial inference server. From that initial foothold, the intruder was able to pivot and breach other segments of Near AI’s broader infrastructural network, demonstrating the dangerous cascading effects of unpatched server-side software vulnerabilities.

Investigators tracking the breach eventually traced the origin of the intrusion back to an internal system that remained connected to Private Chat, a feature that Near AI had previously retired but left inadequately isolated. Through this pathway, the attacker managed to download sensitive personal data, including the names and email addresses of about 100 users. Furthermore, the unauthorized party accessed subscription plan details and account balance information belonging to a subset of those affected individuals, prompting immediate concerns regarding data privacy and user protection.

Beyond user account records, the security breach also impacted the platform’s AI agent ecosystem. The attacker successfully accessed another 18 agents operating on an older deployment of Near AI Agents. From these specific instances, the intruder retrieved comprehensive chat histories, custom settings, and operational logs. Notably, Near AI clarified that these particular agents were not running inside the platform’s specialized confidential computing environment, a security layer specifically engineered to shield sensitive data and user interactions from the very company operating the physical servers.

The forensic review also uncovered that logs from the incident exposed two customer-owned Near AI Cloud API keys. These cryptographic keys function essentially as digital credentials, allowing external applications to seamlessly authenticate and access various cloud services. In response to the discovery, Near AI confirmed that it immediately revoked both compromised API keys. However, the company noted that its investigation had not yet determined whether the attacker actively used the stolen credentials to access external resources before they were deactivated.

Confidential AI Has a Software Problem

Despite the intrusion and subsequent data exfiltration, Near AI reported finding no direct indication that stored Private Chat conversations or previously uploaded user files had been accessed or downloaded by the attacker. The confirmed theft remained strictly limited to legacy account records and older agent data. Nevertheless, the company’s internal investigation acknowledged that the exposure of live confidential requests during the active phase of the exploit remained a distinct possibility that could not be entirely ruled out.

Near AI operates as a prominent component within the broader Near ecosystem, a technological network that has heavily marketed privacy-centric AI solutions alongside its established blockchain scaling initiatives. The platform’s specialized Cloud product relies heavily on trusted execution environments, commonly referred to as TEEs. These hardware-based secure enclaves are designed to keep user prompts fully encrypted and isolated from server administrators, ensuring privacy even while complex models process heavy computational workloads in real time.

However, the recent security incident starkly illustrates that hardware-level isolation alone does not guarantee that the software operating inside the protected environment is entirely safe from exploitation. Near AI frankly acknowledged this architectural limitation in its report, pointing out that hardware security measures do not automatically protect against an inherent vulnerability in the software running concurrently inside the secure environment. In this case, the SGLang flaw effectively created a loophole that permitted the attacker to execute unauthorized code precisely where confidential user requests were actively being processed.

This revelation creates a particularly awkward public relations and technical dilemma for a commercial enterprise that markets robust digital privacy as its core value proposition. Just a month prior to the disclosure, in October, Near AI officially announced that the Brave browser’s popular Leo AI assistant was actively utilizing its confidential inference infrastructure to power a supported AI model. Fortunately, the company’s incident report did not identify any Brave browser users among those whose data was compromised during the breach.

The SGLang engine itself had already attracted considerable scrutiny from the cybersecurity research community prior to this incident. Back in July, the CERT Coordination Center at Carnegie Mellon University documented a series of six distinct vulnerabilities within the SGLang project. These discovered bugs included serious flaws that could potentially allow malicious actors to execute remote commands or expose sensitive credentials, depending entirely on how individual servers were configured and maintained by administrators.

Near AI did not explicitly identify the exact SGLang flaw that was exploited in its specific incident, leaving no definitive basis to link the breach directly to those earlier vulnerability disclosures documented by Carnegie Mellon. Nevertheless, Near AI has formally reported the underlying vulnerability to the developers of the SGLang project to ensure broader ecosystem remediation.

To its credit, the project team moved swiftly and aggressively to contain the damage and remediate the technical flaws upon discovering the unauthorized activity.

Upon detection, the engineering team revoked all active user sessions and administrative credentials, replaced all vulnerable agent tokens, took the legacy Private Chat system completely offline, and deployed an urgent security fix for the SGLang vulnerability across all active inference servers. The company subsequently completed a comprehensive rotation of all remaining credentials alongside a thorough forensic review.

In the wake of the containment efforts, Near AI confirmed that it has directly notified all individual users whose account details or deployed agents were definitively confirmed to have been accessed during the security event. The company also stated that it will fulfill all required regulatory notifications mandated by applicable data protection laws. Furthermore, Near AI issued a general advisory urging all platform users to remain highly vigilant against any unsolicited messages referencing their Near AI accounts or balances, while simultaneously reaching out individually to the owners of all 18 affected agents to provide specific guidance and technical support.