Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers.
The company said in a November 9 report that an attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models and generates responses to user requests.
The exploit allowed the intruder to execute commands on one inference server and then reach other parts of Near AI's infrastructure.
Investigators traced the intrusion to an internal system connected to Private Chat, a feature the company had already retired. The attacker downloaded names and email addresses for approximately 100 users, along with subscription plan and account balance information for some of them.
Another 18 agents were accessed on an older deployment of Near AI Agents, where the attacker retrieved their chat histories, settings and logs. Those agents were not running inside NEAR AI's confidential computing environment, which is designed to shield information from the company operating the servers.
Logs also exposed NEAR AI Cloud API keys belonging to two customers. These keys function like digital credentials that applications use to access cloud services; Near AI says it has revoked both, but did not say whether the attacker used them.
Confidential AI has a software problem
Near AI found no indication that stored Private Chat conversations or uploaded files had been accessed. The confirmed theft involved account records and legacy agent data, while exposure of live confidential requests remains a possibility identified by the investigation.
Near AI is part of the broader Near ecosystem, which has been promoting AI privacy alongside its blockchain ambitions. Its Cloud product uses trusted execution environments, or TEEs, to keep AI prompts encrypted and isolated from server operators, even while models process them.
Hardware isolation does not guarantee that the software inside the protected environment is safe. “It does not protect against a vulnerability in the software running inside the environment,” Near AI acknowledged, explaining that the SGLang flaw let the attacker run code where confidential requests were being processed.
That is particularly awkward for a business selling privacy as a core feature. In October, Near AI announced that Brave's Leo browser assistant was using its confidential inference infrastructure for a supported AI model, although the incident report does not identify Brave users among those affected.
SGLang had already attracted scrutiny from security researchers. In July, Carnegie Mellon University's CERT Coordination Center documented six vulnerabilities in the project, including bugs that could let attackers execute commands or expose credentials, depending on how servers were configured.
Near AI did not identify the specific SGLang flaw exploited in this incident, so there is no basis to link the breach to any of those earlier disclosures. It reported the vulnerability to SGLang's developers.
Near, to its credit, was quick to fix the issues.
“On detection, we revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers,” the project said.
”We've completed the rotation of all remaining credentials and a full forensic review. We have notified users whose account details or agents we have confirmed were accessed and will make any regulatory notifications that are required.”
Near AI notified users whose account records or agents it confirmed were accessed and says it will make any required regulatory notifications. It also warned users to be wary of unsolicited messages referring to their Near AI accounts or balances, and contacted the owners of all 18 affected agents individually.
