Near AI breach via SGLang flaw exposes data of about 100 users, 18 AI agents
In brief
- Near AI disclosed a breach affecting about 100 users and 18 AI agents.
- The attacker exploited a remote code execution flaw in SGLang, an open-source AI engine.
- Two customers' Cloud API keys were exposed in logs, and Near AI said it revoked them.
- Hardware isolation doesn't protect against flaws in software running inside it, Near AI said.
How the attacker got in
Investigators traced the intrusion to an internal system connected to Private Chat (a feature Near AI had already retired), according to the company's November 9 incident report. It started with one inference server running SGLang. From there, the intruder moved into other parts of Near AI's infrastructure.
Near AI hasn't named the specific SGLang flaw that was exploited.
It said it reported the vulnerability to SGLang's developers.
What was taken
The attacker downloaded names and email addresses for about 100 users, plus subscription plan and account balance details for some of them. Another 18 agents on an older deployment of Near AI Agents were accessed, and the attacker retrieved their chat histories, settings and logs. Those agents weren't running inside Near AI's confidential computing environment.
Logs also exposed NEAR AI Cloud API keys belonging to two customers. Near AI said it revoked both keys. It didn't say whether the attacker used them.
Near AI said it found no indication that stored Private Chat conversations or uploaded files had been accessed. The investigation did identify possible exposure of live confidential requests, though the confirmed theft involved account records and legacy agent data.
The limits of hardware privacy
Near AI's Cloud product uses trusted execution environments (TEEs) to keep AI prompts encrypted and isolated from server operators. In the report, the company acknowledged that this kind of hardware isolation has a clear boundary.
"It does not protect against a vulnerability in the software running inside the environment," Near AI said in its incident report.
In October, Near AI announced that Brave's Leo browser assistant was using its confidential inference infrastructure. The incident report didn't identify Brave users among those affected.
On remediation, Near AI said it revoked all active sessions and administrative credentials, replaced agent tokens, took Private Chat offline and deployed an SGLang fix across all inference servers. The company says it's since completed the rotation of all remaining credentials and a full forensic review. Near AI has notified the users it confirmed were affected and contacted the owners of all 18 agents individually. It also said it'll make any regulatory notifications that are required.
Frequently asked questions
How did the attacker breach Near AI's systems?
Near AI said the attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models. The exploit let the intruder execute commands on one inference server and then reach other parts of Near AI's infrastructure. Investigators traced it to an internal system connected to the retired Private Chat feature.
What data was exposed in the Near AI breach?
The attacker downloaded names and email addresses for about 100 users, plus subscription plan and account balance details for some of them. Chat histories, settings and logs from 18 agents on an older deployment were also retrieved. Logs exposed Cloud API keys belonging to two customers, which Near AI said it revoked.
Why didn't trusted execution environments stop the Near AI breach?
Near AI's Cloud product uses TEEs to keep AI prompts encrypted and isolated from server operators. The company acknowledged that hardware isolation does not protect against vulnerabilities in software running inside the protected environment. The 18 affected agents weren't running inside its confidential computing environment.
