NEAR AI SGLang Breach Exposed Account Details of About 100 Users

NEAR AI disclosed that an unauthorized party broke into part of its infrastructure through a remote code execution flaw in SGLang, the open-source inference engine running on its servers. In a security incident report dated November 9, 2026, the company said the attacker downloaded account details for approximately 100 users and accessed 18 agents on a legacy deployment of NEAR AI Agents.

NEAR AI says the access has been closed, affected credentials have been replaced, the vulnerability has been fixed and access to NEAR AI Cloud has been restored. The report also concedes a harder point for a company that sells confidential inference: on November 8 the intruder could have observed user requests on the compromised server, including requests running in confidential mode.

01NEAR AI breach scope: accounts, agents and requests

The confirmed data loss has three parts. First, the attacker reached an internal system that sat behind Private Chat, a product NEAR AI had already deprecated, and downloaded account details for approximately 100 users. Those details were email addresses and names, plus plan and balance information for some accounts.

Second, the intruder accessed 18 agents on a legacy deployment of NEAR AI Agents. Those agents were not running inside NEAR AI's confidential computing environment, which is built on trusted execution environments (TEEs). For those 18 agents, the data retrieved included chat history, settings and logs.

Third, two NEAR AI Cloud customers had API keys exposed in logs, and NEAR AI says those keys have been revoked. On the other side of the ledger, the company says it found no indication that stored Private Chat conversations or uploaded files were accessed.

02SGLang inference server as the entry point

SGLang is the open-source engine NEAR AI uses to serve models. According to the report, the remote code execution vulnerability gave the attacker code execution on one inference server, and from that foothold they moved on to other parts of NEAR AI's infrastructure.

A summary of the report on the NEAR AI blog describes the bug as an unpatched SGLang vulnerability. The report does not name a CVE identifier or a patched SGLang release, and it does not describe how the flaw works. Teams that run SGLang themselves have no version number from this disclosure to check against, so they will need to follow the SGLang project directly.

The incident shows how far one compromised inference node can reach. A model server is often treated as a compute box, yet here it became the starting point for access to an internal account system, a legacy agent platform and logs holding customer API keys.

03NEAR AI incident response and credential rotation

NEAR AI lists its containment steps in order. On detection, it revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline and deployed a fix for the SGLang vulnerability across all inference servers.

After that, the company says it completed the rotation of all remaining credentials and a full forensic review. It has notified users whose account details or agents it confirmed were accessed. NEAR AI also says it will make any regulatory notifications that are required.

The company reported the vulnerability to the SGLang project. NEAR AI Cloud access has been restored, while Private Chat, which was already deprecated, was taken offline as part of the response.

04Confidential computing limits exposed by the incident

NEAR AI uses its own report to spell out what confidential computing does and does not cover. Confidential computing protects data from the operator and the host, the company writes, but it does not protect against a vulnerability in the software running inside the environment.

That gap is what the attacker used. The SGLang flaw let them run code inside one inference server and access requests that were being processed on that server, including confidential ones, for the window NEAR AI identifies as November 8.

NEAR AI says it is now treating the inference software and the services around the enclave with the same rigor as the enclave itself when it runs security analysis. It adds that the code, dependencies and deployment configurations for its confidential inference stack remain public so that anyone can verify what is running. The point matters for a company whose NEAR AI Gateway launch two days later pitches private models running in secure hardware enclaves.

05Affected users, phishing risk and open questions

Affected users have been contacted directly from security@near.ai with the steps that apply to them, and the 18 agent owners were contacted individually. NEAR AI points all questions to that same address.

Because names, emails and in some cases balances were taken, the company advises caution with any unsolicited message that references a user's account or balance. That is the standard risk after an account-details leak: the stolen data makes phishing emails look more credible.

Several details are still missing from the public report. NEAR AI does not say when the intrusion began, how it was detected or how many confidential-mode requests passed through the affected server on November 8. It also does not identify the SGLang flaw by CVE, so outside teams cannot yet match their own deployments to this incident.