NEAR AI says SGLang vulnerability exposed user account details in security breach
NEAR AI has contained a security breach after an attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine running on its servers. NEAR AI is the AI product and infrastructure arm of the NEAR (NEAR) ecosystem.According to NEAR AI's security incident report published on Monday, the attacker gained code execution on one inference server from the vulnerability and reached an internal system behind a previously deprecated Private Chat feature.From there, the attacker downloaded account details — including email addresses, names, and in some cases plan and balance information — for approximately 100 users.The attacker also accessed 18 agents on a legacy NEAR AI Agents deployment that was not running in the company’s confidential computing environment, including their chat history, settings, and logs. Two Cloud customers had their API keys exposed in logs, while those keys have since been revoked.Its report says that on Nov. 8, the attacker could have observed user requests being processed on the compromised server, including those in confidential mode. However, NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed."Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here," NEAR AI said. "The SGLang vulnerability let the party run code inside one inference server and access requests in processing on that server, including confidential ones."Vulnerability patchedThe company said it has closed the access, replaced the affected credentials, and patched the vulnerability across all inference servers. Access to NEAR AI Cloud, which was paused during the investigation, has been restored.NEAR AI also revoked active sessions and administrative credentials, rotated agent tokens, took Private Chat offline, and completed a full forensic review along with remaining credential rotations."We are now treating the inference software and the services around the enclave with the same rigor as the enclave itself when running security analysis, and the code, dependencies, and deployment configurations for our confidential inference stack remain public so that anyone can verify what is running," NEAR AI said.The company has reached out to the affected users and the owners of the 18 agents individually.