Summary
- A remote code execution vulnerability in SGLang allowed an attacker to compromise a NEAR AI inference server and reach supporting infrastructure.
- Account information for approximately 100 users and 18 legacy agents was accessed; two customer API keys were exposed in logs.
- Requests processed in confidential mode may have been observable during the intrusion, but stored Private Chat conversations were not found to have been accessed.
Attackers exploited a vulnerability in the software operating an AI inference server at NEAR AI, exposing customer information and showing how weaknesses inside confidential computing environments can undermine protections intended to isolate sensitive workloads.
The company disclosed the incident on 9 November, confirming that an unauthorised party exploited a remote code execution vulnerability in SGLang, the open-source inference engine running on its servers.
The attacker obtained code execution on one inference server and subsequently reached additional internal infrastructure. NEAR AI says the intrusion exposed account details for approximately 100 users, information associated with 18 legacy agents and API keys belonging to two cloud customers.
The company has closed the access route, replaced affected credentials and deployed a correction for the SGLang vulnerability across its inference servers. NEAR AI Cloud access, which was interrupted during the response, has been restored.
The investigation also identified a potential exposure affecting requests processed on the compromised server on 8 November, including some operating in confidential mode.
NEAR AI describes those requests as potentially observable during processing, rather than confirming that an attacker downloaded or retained every affected request.
Inference software provided the initial entry point
SGLang is an open-source framework used to serve large language models and process inference requests. In a hosted environment, it forms part of the software responsible for receiving requests, executing model workloads and returning results.
A remote code execution vulnerability in that layer can provide an attacker with the ability to run unauthorised instructions within the affected server’s operating environment.
In NEAR AI’s case, that initial compromise enabled further access to an internal service associated with its previously deprecated Private Chat product.
The attacker downloaded account information including email addresses and names, as well as plan and balance details for some users. NEAR AI estimates that approximately 100 accounts were involved.
Its investigation also found access to 18 agents hosted on an older version of NEAR AI Agents. Those agents were not operating within the company’s confidential computing trusted execution environment.
The accessed legacy agent information included chat histories, settings and logs. Two NEAR AI Cloud customers had API keys exposed through logging records; the company says those credentials have been revoked.
NEAR AI reports no indication that stored Private Chat conversations or uploaded files were accessed. That finding should be distinguished from the confirmed exposure of the legacy agents’ chat histories and from the potential observation of requests being processed on the compromised inference server.
Confidential computing does not protect vulnerable code
Confidential computing uses hardware-backed isolation to protect data while it is being processed, including from certain forms of access by the host operating environment or infrastructure administrator.
Those protections rely on a distinction between software operating inside a trusted execution environment and systems outside it. They do not guarantee that the application code within the protected environment is free of exploitable vulnerabilities.
The NEAR AI incident illustrates that boundary. According to the company, the SGLang weakness allowed the attacker to execute code within the inference server itself, where requests could be processed in decrypted form.
Hardware-backed isolation may prevent external systems from observing protected memory, but it cannot automatically prevent malicious execution introduced through a flaw in the software entrusted with processing that data.
Consequently, an application vulnerability can create exposure even when the underlying confidential computing technology operates according to its intended security model.
That distinction matters for organisations evaluating hosted AI services that offer privacy or confidential inference capabilities. The protection of model requests depends on both the computing environment and the software responsible for handling those requests.
Successful isolation of the infrastructure provider does not independently establish that an inference engine, application dependency or connected service cannot be compromised.
Recovery includes credentials and legacy services
NEAR AI says it revoked active sessions and administrative credentials, replaced agent tokens, disabled Private Chat and rotated remaining credentials as part of its response.
The company also reports completing a forensic review and notifying users whose account information or agents were confirmed to have been accessed. It says it will make any regulatory notifications required by the incident.
The vulnerability has been reported to the SGLang project, although NEAR AI’s public incident account does not provide sufficient details to establish the exposure of every independent SGLang deployment.
The company says it is extending security analysis to the inference software and supporting services surrounding its confidential computing environment. Its confidential inference code, dependencies and deployment configurations remain publicly available for inspection.
These measures reflect the breadth of an AI service’s security dependencies. A protected execution environment may contain the core workload, while logging systems, account databases, agent services and administrative interfaces remain separate potential sources of exposure.
The investigation has established access to customer records and legacy agent data, together with possible observation of in-flight confidential requests. NEAR AI has not established that stored Private Chat content was downloaded or that the attacker retained every request processed during the period of access.
Its confirmed findings nevertheless demonstrate that vulnerabilities in inference software can bypass the intended practical benefits of confidential execution without requiring a failure of the underlying hardware isolation technology.
