NEAR AI: SGLang flaw, 18 agents, about 100 users

NEAR AI’s November 9 incident report says an attacker used a remote code execution flaw in SGLang, the open-source inference engine on its servers, and ran code on one inference server. From there the attacker reached further into the company. On November 8 that person could have read requests being processed on the compromised server, including requests the company handles in confidential mode. NEAR AI Cloud was paused for the investigation and has since been restored. The public report names SGLang and leaves both the CVE and the fixed upstream version unpublished. NEAR AI says it reported the bug to the project and deployed its own fix on every inference server it runs.

Confidential mode is a trusted execution environment meant to keep a request private from the operator and the host. NEAR AI’s report draws the boundary in one place: a flaw in the software inside the enclave still exposes the request. SGLang was that software. Code execution inside the enclave was enough to see what the enclave was processing that day.

What left, and what the review says stayed

The attacker reached an internal system behind Private Chat, a product NEAR AI had already deprecated, and downloaded account details for about 100 users: email addresses, names, and for some accounts the plan and the balance. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were opened. Private Chat has been taken offline.

A second set was outside the enclave. Eighteen agents on an older NEAR AI Agents deployment were not running in confidential computing. From those agents the attacker took chat history, settings, and logs. Two NEAR AI Cloud customers had API keys sitting in logs. NEAR AI says both keys are revoked. It has not said whether those keys were used before the revocation.

On detection the company revoked active sessions and administrator credentials, replaced agent tokens, rotated the remaining credentials, and finished a forensic review. Users whose account details or agents were confirmed accessed were contacted from [email protected], with the steps that apply to them. A later note said people who have not heard from the company do not need to take action. The same public record leaves open whether everyone whose request passed through the affected server on November 8 was in that contacted group.

Brave wrote on October 15 that its Leo assistant runs chats with the GLM 5.3 Flash model inside a trusted execution environment operated by NEAR AI. NEAR AI has not said whether the compromised server handled any of those chats.

What NEAR AI customers should do

If a message about this incident arrives, the sender that matters is [email protected]. Treat a note about an account balance, a plan, or a reset that you did not ask for as a phish, especially one that does not come from that address. The stolen fields are exactly the fields a follow-on message would quote back: a name, an email, a plan, a balance.

Customers who did receive the notice should follow the steps in it, then confirm the two classes of secret the report names. Cloud API keys that ever appeared in a NEAR AI log should be dead at NEAR AI and unused in any client that stored a copy. Agent owners among the 18 should assume chat history, settings, and logs from that legacy deployment are in someone else’s hands, and rotate any credential that history could contain.

A missing email is the company’s current guidance that no confirmed account-detail or agent access applies to you. It is a weak answer for a prompt that crossed the affected server on November 8, including a confidential-mode prompt. Anyone who sent sensitive material that day, and who has not been told whether their traffic used that server, should treat the prompt as exposed and rotate anything they pasted into it.

What anyone else running SGLang should do

SGLang is open source, and the bug was not unique to one host. NEAR AI’s report gives operators a class of flaw, remote code execution in the inference engine, and withholds the version line. Until the project publishes a fixed release, take any SGLang listener off the open internet. A trusted execution environment around that process does not close the hole, because the vulnerable code is what runs inside the environment.

Inventory where SGLang sits: inference clusters, agent hosts, and any product that embedded the package. Rotate model keys, gateway tokens, and customer credentials that the process could read, including keys written into request logs. Then watch the SGLang project’s advisories for the CVE and the version NEAR AI’s private fix corresponds to. A server left reachable until that note arrives is the same shape of target this incident already used.

This briefing relies on public reporting by The Hacker News and on NEAR AI’s incident report.