SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

Summary

An attacker exploited a remote code execution flaw in the open-source SGLang inference engine to run code on one NEAR AI inference server, according to the supplied November 10, 2026 report. The attacker could potentially have observed requests processed on that server during the affected Sunday, including confidential-mode requests. This is a reported in-the-wild exploitation incident, but the evidence does not identify the attacker or establish a broader campaign.^[0]

The confirmed downstream theft affected two distinct product environments. From an internal system behind the deprecated Private Chat product, the attacker downloaded account details for about 100 users: names and email addresses, plus plan and balance information for some accounts. NEAR AI reported no sign that stored Private Chat conversations or uploaded files were accessed. Separately, the attacker took chat history, settings, logs, and other data from 18 agents on an older NEAR AI Agents deployment that did not run inside the company's trusted execution environment. Two customers' NEAR AI Cloud API keys were exposed in logs and subsequently revoked.^[0]

The confidential-computing implication is specific: SGLang itself operated inside the trusted execution environment, so that environment did not protect requests against a vulnerability in the software processing them. Potential exposure of live inference requests must remain distinct from the confirmed theft of account and agent data. The report does not establish which requests were observed, whether any were retained by the attacker, or whether users with potentially exposed requests were included in direct notifications.^[0]

NEAR AI reported closing the attacker's access, deploying a SGLang fix across all inference servers, revoking sessions and credentials, replacing agent tokens, taking Private Chat offline, completing a forensic review, and restoring NEAR AI Cloud access. The intelligence picture remains limited to one supplied secondary report: no CVE, affected SGLang version range, upstream fixed release, exploit root cause, or actionable attacker indicators are provided. The linked incident report and follow-up are described by the article, not supplied as separate corroborating documents.^[0]

Attack chain

1. Initial exploitation and code execution: The attacker exploited a SGLang remote code execution flaw on one NEAR AI inference server. SGLang ran inside the server's trusted execution environment, placing the compromised software within the environment processing confidential requests. NEAR AI said requests handled on that server during the affected Sunday could have been visible to the attacker; actual collection of those requests is not confirmed.^[0]
2. Expansion into additional NEAR AI systems: After obtaining inference-server access, the attacker moved further into NEAR AI systems and reached an internal system behind Private Chat as well as 18 agents on an older, non-TEE NEAR AI Agents deployment. The article does not describe the credentials, interfaces, or technical paths used for this expansion, nor the relative order in which the two downstream environments were accessed.^[0]
3. Data theft and credential exposure: The attacker downloaded Private Chat account details for about 100 users and took agent data including chat history, settings, and logs. Two customers' Cloud API keys were exposed in logs. The evidence does not establish subsequent use of those keys, and NEAR AI reported revoking both.^[0]

Disclosure timeline

How it works

The reported entry point was a remote code execution vulnerability in SGLang, the inference engine used on the affected NEAR AI server. Exploitation allowed attacker-controlled code to run on that server. The supplied account does not identify the vulnerable component, triggering input, endpoint, authentication requirements, or underlying programming error, so a more detailed exploit mechanism cannot be established.^[0]

The relevant trust boundary was inside the confidential-computing environment. NEAR AI's confidential mode processed requests within a trusted execution environment intended to keep them private even from the company. Because SGLang ran inside that environment, exploitation of SGLang could expose requests available to the compromised software. This is not evidence of a break in TEE hardware isolation; the company's explanation was that the TEE did not protect against vulnerabilities in software running inside it.^[0]

The subsequent compromise extended beyond the inference workload to Private Chat infrastructure and an older agent deployment outside the TEE. The report establishes that expansion and the resulting theft, but does not explain how access crossed between systems. Exposure of API keys in agent logs is a documented consequence, not an established explanation for the initial exploitation or subsequent movement.^[0]

Affected versions and patch status

Key takeaways

• A TEE does not remove the need to secure the software running inside it. In this incident, the reported SGLang compromise occurred within the environment processing confidential requests, creating potential visibility into those requests without an established defeat of the TEE's hardware protections.^[0]
• Maintain separate impact categories: account and legacy-agent data theft was confirmed, live inference-request exposure was possible, and NEAR AI reported no signs of access to stored Private Chat conversations or uploaded files. These findings should not be collapsed into either universal chat compromise or universal chat safety.^[0]
• NEAR AI's reported deployment of a fix is not confirmation of an upstream SGLang patched release. The missing CVE, version range, and exploit details limit broader vulnerability assessment, while the absence of attacker indicators in the supplied report prevents indicator-based hunting from this evidence alone.^[0]

Defensive actions

• Apply the SGLang remediation across the full NEAR AI inference-server fleet, as the company reports having done.: The initial compromise used SGLang code execution on one inference server. NEAR AI reported fixing every inference server rather than only the compromised host. The article does not identify a generally available upstream release that other operators can select.^[0]
• Invalidate active sessions and administrator credentials, replace agent tokens, and rotate remaining credentials in the affected environment.: These were reported NEAR AI containment actions after the attacker expanded beyond the inference server into internal product systems. They address the credentials and access state within the incident's documented scope.^[0]
• Revoke the Cloud API keys exposed in agent logs.: The stolen agent material included logs exposing two customers' NEAR AI Cloud API keys. NEAR AI reported revoking both; the evidence does not establish that the attacker used them.^[0]
• Take the deprecated Private Chat service offline as part of containment.: The attacker reached an internal system behind this already deprecated product and downloaded user account information. NEAR AI reported taking the service offline after detecting the attack.^[0]
• Follow the incident-specific instructions in direct NEAR AI notifications; retain the company's stated distinction for users who were not contacted.: NEAR AI contacted users whose account details or agents were confirmed accessed and supplied applicable steps. Its reported follow-up said users who had not heard from the company did not need to act. The article does not clarify whether users with potentially exposed inference requests were included in those notices.^[0]
• Treat unsolicited messages concerning a NEAR AI account or balance with caution.: NEAR AI specifically issued this precaution after theft of names, email addresses, and, for some accounts, plan and balance information. The warning is precautionary; the article does not report an observed follow-on phishing campaign.^[0]