NEAR AI Breach Exposes Critical Flaw in SGLang Security, Compromises 100 Users and 18 AI Agents

SGLang Vulnerability Triggers NEAR AI Breach

NEAR AI disclosed a significant NEAR AI breach after an attacker exploited a remote code execution exploit in SGLang, an open-source inference engine that powers AI model responses. The attack occurred on November 8, when the intruder executed unauthorized code on one of NEAR AI's inference servers1

1

. This SGLang vulnerability allowed the attacker to penetrate deeper into the company's AI infrastructure security, reaching internal systems that had been deprecated but remained accessible. The breach highlights critical weaknesses in how software vulnerabilities can bypass even advanced hardware-backed privacy protections designed to safeguard user data.

Data Breach Exposes User Details and AI Agent Information

The data breach exposes user details for approximately 100 individuals who used NEAR AI's Private Chat feature, a product the company had already retired. Compromised information included email addresses, names, and for some accounts, subscription plan and balance data2

2

. The attacker also accessed 18 AI agents running on an older deployment of NEAR AI Agents that operated outside the company's Trusted Execution Environment. From these agents, the intruder extracted chat history, configuration settings and operational logs1

1

. Additionally, API keys belonging to two NEAR AI Cloud customers were exposed through system logs, prompting immediate revocation by the company2

2

.

Trusted Execution Environment Fails to Prevent Attack

The breach exposed fundamental limitations in NEAR AI's security architecture. While the company processes confidential requests inside a Trusted Execution Environment designed to keep data private even from NEAR AI itself, this hardware protection proved insufficient. "It does not protect against a vulnerability in the software running inside the environment," NEAR AI acknowledged in its post-incident report1

1

. Because SGLang runs inside the TEE, the attacker could potentially view requests processed on the affected inference server on November 8, including those submitted in confidential mode2

2

. This revelation is particularly concerning for a company marketing AI security and privacy as core features, especially given NEAR AI's October announcement that Brave's Leo browser assistant uses its confidential inference infrastructure.

Swift Response and Forensic Review Contain Damage

Upon detecting the intrusion, NEAR AI initiated immediate containment measures. The company revoked all active sessions and administrator credentials, replaced all agent tokens, and took Private Chat offline1

1

. Engineers deployed a fix for the SGLang vulnerability across all inference servers and rotated remaining credentials. A complete forensic review confirmed that stored Private Chat conversations and uploaded files were not accessed during the breach2

2

. NEAR AI has since restored access to its Cloud service and contacted affected users directly from [email protected]. The company reported the flaw to the SGLang project but has not disclosed the CVE number, affected versions, or whether a public fix has been released.

Broader Implications for AI Infrastructure Security

This incident raises critical questions about AI security in production environments where open-source inference engines handle sensitive data. SGLang had previously attracted scrutiny from security researchers, with Carnegie Mellon University's CERT Coordination Center documenting six software vulnerabilities in July, including bugs enabling command execution and credential exposure2

2

. While NEAR AI has not confirmed whether this breach relates to those earlier disclosures, the attack demonstrates how rapidly evolving AI infrastructure creates new attack surfaces. Organizations relying on hardware-backed privacy protections must recognize that TEEs cannot compensate for vulnerable software running inside them. As AI adoption accelerates, companies must implement layered security approaches combining hardware isolation with rigorous software validation and continuous monitoring of their inference servers to protect against similar remote code execution exploits.