NEAR AI has confirmed a security incident in which a remote-code-execution flaw in SGLang, the open-source inference engine on its servers, gave an attacker code execution on one inference server and, from there, access to part of its infrastructure. The company’s security incident report, dated 9 November 2026, says the access has been closed, affected credentials have been replaced, a fix has been deployed across all inference servers, and access to NEAR AI Cloud has been restored.
NEAR Protocol was not affected, and nor were other NEAR services. That distinction was repeated in a series of posts from @near_ai on X, which first reported unauthorised access to NEAR AI internal systems at 23:14 GMT on 9 November, said Cloud inference had been paused, and later confirmed that Cloud was back online.
No CVE has been named for the SGLang flaw, and NEAR AI has not identified the attacker. The company says it has reported the vulnerability to the SGLang project. TSN has not seen a public SGLang advisory, and this report does not claim that the flaw is unpatched upstream.
About 100 users, 18 agents and two API keys
The investigation so far, NEAR AI says, found that the attacker reached an internal system behind a previously deprecated Private Chat service and downloaded account details — email addresses, names, and for some accounts plan and balance information — for approximately 100 users. There was also access to 18 agents on a legacy deployment of NEAR AI Agents that were not running in the company’s confidential computing (TEE) environment. For those 18 agents, the data retrieved included chat history, settings and logs.
On 8 November, the company says, the attacker “could also have observed user requests being processed on the accessed server, including requests running in confidential mode.” It has found no indication that stored Private Chat conversations or uploaded files were accessed. Two Cloud customers had NEAR AI Cloud API keys exposed in logs; those keys have been revoked.
NEAR AI says it has notified users whose account details or agents it has confirmed were accessed, revoked all active sessions and administrative credentials, replaced all agent tokens, and taken Private Chat offline. A later post on X, at 06:38 GMT on 10 November, said: “On November 8, an attacker used a vulnerability in SGLang… We’ve closed the access and fixed it.” Affected users have been contacted from [email protected]. The company tells customers to treat unsolicited messages that mention an account or balance with caution.
This matters for more than NEAR AI’s own chat product. TSN has previously covered how Brave encrypts Leo AI chats in NEAR AI hardware enclaves. The incident is also the latest in a run of AI developer-platform breaches that have shown how a flaw in the software around a model can matter as much as the model itself.
What confidential computing did and did not cover
NEAR AI’s Cloud inference is marketed as running inside hardware-isolated secure enclaves. The incident report is blunt about the limit of that design:
“Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment.”
That, the company says, is what happened here: the SGLang vulnerability let the attacker run code inside one inference server and access requests in processing on that server, including confidential ones. The 18 agents that were reached sat outside the TEE environment. The requests that could have been observed on 8 November included some that were running in confidential mode.
NEAR AI says it is now treating the inference software and the services around the enclave with the same rigour as the enclave itself in security analysis, and that the code, dependencies and deployment configurations for its confidential inference stack remain public so that anyone can verify what is running. Those are the company’s own commitments, not an independent audit.
A TEE is not a patch for the software inside it
The useful fact in this incident is not that a hardware enclave “failed.” It is that the enclave did the job it is built for, and that job has a hard boundary. Confidential computing is meant to keep an operator or a host from reading data in use. It is not a substitute for the security of the inference engine running inside that boundary. Once a remote-code-execution flaw exists in that engine, the isolation that matters to customers can be crossed from within.
That is why the 8 November window, in which requests in confidential mode could have been observed on the accessed server, sits at the centre of the report. The same limit should be read back onto earlier promises about private inference, including Brave’s Leo arrangement with NEAR AI. A user can still ask whether the code inside the enclave is the code they think it is. They should not assume that “confidential mode” is a complete answer to a bug in SGLang, or in any other engine sat in the same place.
What remains unknown is as important as what NEAR AI has published. The attacker has not been named. No CVE is attached to the flaw. The company has told the SGLang project, but an upstream advisory is not yet part of the public record in this story. The next facts to watch are a CVE or a vendor advisory, and whether any of the approximately 100 affected accounts, or the two revoked Cloud API keys, are later tied to follow-on misuse.
Sources
- NEAR AI, “Security Incident Report”, 9 November 2026
- @near_ai on X, 9 November 2026, 23:14 GMT
- @near_ai on X, 10 November 2026, 01:20 GMT
- @near_ai on X, 10 November 2026, 03:32 GMT
- @near_ai on X, 10 November 2026, 06:38 GMT
Related stories
Brave’s arrangement to run Leo chats in NEAR AI hardware enclaves is the nearest next read, because it is the most direct TSN account of confidential inference on this same cloud.
Also relevant: Wiz’s count of AI developer-platform breaches in “Black October”, and Perplexity’s plan to run its AI inside client systems.
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
