Near AI Server Breach May Have Exposed Confidential AI Requests
Key Takeaways
- •An attacker exploited a remote code execution vulnerability in SGLang, an open-source AI inference engine, to break into Near AI's systems on November 8.
- •The intruder obtained personal information for roughly 100 users, data tied to 18 AI agents on an older deployment, and Cloud API keys belonging to two customers.
- •Near AI acknowledged that its trusted execution environments cannot stop attacks on vulnerabilities in the software running inside them, which is how the SGLang flaw reached the space handling confidential requests.
- •It remains unknown whether live confidential AI requests were actually viewed or whether the exposed API keys were ever used by the attacker.
- •Near AI responded by revoking sessions and credentials, replacing agent tokens, taking Private Chat offline, patching SGLang across its servers, and completing a forensic review before restoring Cloud access.
Near AI has disclosed that an attacker may have seen confidential AI requests processed on one of its servers on November 8. The company revealed the breach in a security report published on November 9, one day after the incident. The breach also exposed account details for roughly 100 users and data from 18 AI agents.
How the Intrusion Happened
The attacker got in through SGLang, a widely used open-source engine for running AI models. SGLang is an open-source project for serving large language models and is used to power inference workloads. A remote code execution (RCE) flaw allowed the intruder to execute commands on one inference server. From that foothold, the attacker then reached other parts of Near AI's systems.
What the Attacker Took
Investigators traced the intrusion to an internal system linked to Private Chat, a feature the company had already retired. The attacker downloaded names and email addresses for about 100 users, plus plan and balance details for some of them. Near AI did not say how many of those users had plan or balance information exposed.
The intruder also accessed 18 agents on an older deployment of Near AI Agents. Their chat histories, settings and logs were taken. Those agents were not running inside the company's confidential computing environment.
Logs further exposed Near AI Cloud API keys belonging to two customers. Near AI said both keys have been revoked, but it did not say whether the attacker used them.
The company found no sign that stored Private Chat conversations or uploaded files were accessed. The possible exposure of live confidential requests remains an open finding. The unresolved questions are whether any live requests were actually viewed and whether either exposed API key was used; Near AI's report does not resolve either point.
An attacker exploited an SGLang RCE flaw to breach NEAR AI. Data stolen from 18 AI agents and about 100 user accounts. Confidential AI requests processed on one server may also have been visible to the attacker. What NEAR AI confirmed about the breach ↓… pic.twitter.com/scaiuPctvW
— The Hacker News (@TheHackersNews) November 10, 2026
Why Hardware Protection Fell Short
Near AI's Cloud product uses trusted execution environments, or TEEs. These secure hardware zones keep AI prompts encrypted and hidden from server operators while models process them. The company said this setup guards data from both the operator and the host machine.
"It does not protect against a vulnerability in the software running inside the environment," Near AI wrote.
The SGLang flaw let the attacker run code inside the same space where confidential requests were handled.
Context: Privacy Push and Prior SGLang Warnings
Near AI is part of the wider Near ecosystem, which has promoted AI privacy as a core feature alongside its blockchain work. In October, Near AI said Brave's Leo browser assistant was using its confidential inference system. The incident report does not name Brave users among those affected.
SGLang had already drawn attention from security researchers. In July, Carnegie Mellon University's CERT Coordination Center listed six flaws in the project, including bugs that could allow command execution or leak credentials. Near AI did not name the specific flaw used in this attack, so there is no basis to link it to those earlier reports. The company said it has reported the flaw to SGLang's developers.
Response and Remediation
After detecting the breach, Near AI revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline and rolled out an SGLang fix on all inference servers. The company said it has finished rotating all remaining credentials and completed a full forensic review. Access to Near AI Cloud has been restored. The full report is published on the company's official blog.
Near AI said it will now review its inference software and surrounding services with the same care it applies to its secure hardware. The code, dependencies and deployment settings for its confidential inference system remain public, so anyone can verify what is running.
Affected users were contacted from the company's security email address with steps that apply to them. The owners of all 18 affected agents were contacted one by one. Near AI said it will make any required regulatory notifications and warned users to treat unsolicited messages about their accounts or balances with caution.
This story was first reported by Blockonomi.
