The Pulse
NEAR AI reports SGLang flaw exposed inference server and user data
NEAR AI says a vulnerability in the SGLang inference engine enabled unauthorized access to one server and part of its infrastructure. The company reports that account details for about 100 users and data from 18 legacy agents were accessed.
AI.info Team · Written with AI · fact-checked ·
Access through an inference server
NEAR AI said on November 9 that it had identified and contained unauthorized access to part of its infrastructure. It closed the access, replaced affected credentials, fixed the vulnerability and restored access to NEAR AI Cloud.
According to the incident report, the unauthorized party exploited a remote code execution vulnerability in SGLang, the open-source inference engine running on NEAR AI’s servers. The flaw gave the party code execution on one inference server and, from there, access to the company’s infrastructure.
Account and agent data
Its investigation confirmed that the party reached an internal system behind the previously deprecated Private Chat service. The party, the company said, downloaded account details for approximately 100 users: email addresses and names, and, for some accounts, plan and balance information.
The report also said the party accessed 18 agents on a legacy deployment of NEAR AI Agents. Those agents were not running in NEAR AI’s confidential computing environment, which the company refers to as a TEE. Data retrieved from the agents included chat history, settings and logs.
Two NEAR AI Cloud customers had API keys exposed in logs, according to the report; those keys were revoked. On November 8, the unauthorized party could also have observed requests being processed on the accessed server, including requests running in confidential mode, according to the company.
The company said it had found no indication that stored Private Chat conversations or uploaded files were accessed. That statement was separate from its account of the 18 agents, for which it said chat history, settings and logs were retrieved.
Response and investigation
After detecting the incident, it revoked active sessions and administrative credentials, replaced agent tokens and took Private Chat offline. It deployed a fix for the SGLang vulnerability across all inference servers.
It completed rotation of its remaining credentials and a full forensic review. It had notified users whose account details or agents it confirmed were accessed, and would make any regulatory notifications that were required.
Limits of confidential computing
Confidential computing, NEAR AI said, protects data from the operator and the host, but not from a vulnerability in software running inside the environment. In this incident, the company said, the SGLang flaw let the unauthorized party run code on one inference server and access requests being processed there, including confidential requests.
It reported the vulnerability to the SGLang project and was applying the same rigor to inference software and services around the enclave as to the enclave itself during security analysis. The code, dependencies and deployment configurations for its confidential inference stack remain public, NEAR AI also said, so that others can verify what is running.