NEAR AI has disclosed a security breach in which an attacker exploited a flaw in third-party software running the company's servers, accessed internal systems, and downloaded account details belonging to approximately 100 users along with data tied to 18 AI agents.

In a security incident report published November 9, the company said the intruder leveraged a remote code execution vulnerability — a flaw that allows an attacker to run arbitrary commands on a targeted system — in SGLang, an open-source engine used to run AI models and generate responses to user requests. The exploit allowed the attacker to execute commands on one inference server and then reach other parts of NEAR AI's infrastructure.

Investigators traced the intrusion to an internal system connected to Private Chat, a feature the company had already retired. The episode is a reminder that data tied to retired products can remain reachable inside a company's infrastructure. According to the company's incident report, the attacker downloaded the names and email addresses of approximately 100 users, along with subscription plan and account balance information for some of them.

The breach also reached an older deployment of Near AI Agents, where 18 agents were accessed and their chat histories, settings, and logs retrieved. Those agents were not running inside NEAR AI's confidential computing environment, which is designed to shield information from the company operating the servers, the report noted.

Logs additionally exposed NEAR AI Cloud API keys belonging to two customers. These keys function like digital credentials that applications use to access cloud services; Near AI said it has revoked both but did not say whether the attacker used them.

The company also said confidential-mode requests processed on November 8 may have been visible to the attacker, although the investigation found no indication that stored Private Chat conversations or uploaded files had been accessed. The confirmed theft involved account records and legacy agent data, while exposure of live confidential requests remains a possibility identified by the investigation.

Confidential AI has a software problem

Near AI is part of the broader Near ecosystem, which has been promoting AI privacy alongside its blockchain ambitions. Its Cloud product uses trusted execution environments, or TEEs, to keep AI prompts encrypted and isolated from server operators, even while models process them.

Hardware isolation, however, does not guarantee that the software inside the protected environment is safe. "It does not protect against a vulnerability in the software running inside the environment," Near AI acknowledged, explaining that the SGLang flaw let the attacker run code where confidential requests were being processed.

For a business that sells privacy as a core feature, the software gap is a significant caveat. In October, Near AI announced that Brave's Leo browser assistant was using its confidential inference infrastructure for a supported AI model, although the incident report does not identify Brave users among those affected.

SGLang had already attracted scrutiny from security researchers. In July, Carnegie Mellon University's CERT Coordination Center, the vulnerability coordination arm of the university's Software Engineering Institute, documented six vulnerabilities in the project, including bugs that could let attackers execute commands or expose credentials, depending on how servers were configured. Near AI did not identify the specific SGLang flaw exploited in this incident, so there is no basis to link the breach to any of those earlier disclosures. It reported the vulnerability to SGLang's developers.

Near AI said it moved quickly to contain the incident. "On detection, we revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers," the project said. "We've completed the rotation of all remaining credentials and a full forensic review. We have notified users whose account details or agents we have confirmed were accessed and will make any regulatory notifications that are required."

The company also cautioned users to stay alert for unsolicited messages that reference their Near AI accounts or balances, and said it contacted the owners of all 18 affected agents individually. Further detail could emerge from two channels: the regulatory notifications Near AI said it will make where required, and any advisory from SGLang's developers, to whom the company reported the specific flaw without publicly naming it.