TL;DR: NEAR AI says an attacker exploited a bug in SGLang, the open-source inference engine running on its servers, to break into one of its machines and reach a deprecated chat feature behind it. The company says roughly 100 user accounts had details like names, emails and in some cases balance info exposed, 18 legacy AI agents had their chat history and settings accessed, and two customers had Cloud API keys leak into logs. NEAR AI has patched the flaw, rotated credentials and restored its Cloud service, and it’s notifying everyone affected directly.
NEAR AI, the AI product and infrastructure arm of the NEAR Protocol ecosystem, disclosed this week that it had a real security incident on its hands, not a hypothetical one. The company runs inference servers for customers who build and host AI agents, and it has leaned hard on the idea that its confidential computing setup keeps that activity private even from NEAR AI itself. This breach is a reminder that the hardware-level privacy guarantee and the software stack running on top of it are two different problems.
How the attacker got in
According to NEAR AI’s own incident report, the opening came through SGLang, a widely used open-source inference engine that powers a lot of production LLM serving today, including on NEAR AI’s own infrastructure. The company says the attacker found a remote code execution flaw in SGLang and used it to run code on one inference server. From that single foothold, they worked their way into an internal system that sat behind a Private Chat feature NEAR AI had already deprecated but, notably, hadn’t fully torn down.
That’s the part worth sitting with. A lot of companies assume an old, “turned off” feature is a dead end for attackers. Here it was a hallway that led straight into systems that were still very much alive.
What actually got exposed
NEAR AI’s numbers are specific, which is a good sign for how seriously to take the disclosure. About 100 user accounts had details exposed, including email addresses and names, and for some accounts, plan and balance information too. Separately, 18 AI agents running on a legacy deployment that wasn’t inside NEAR AI’s confidential computing environment had their chat history, settings and logs accessed by the attacker.
Two NEAR AI Cloud customers also had API keys show up in exposed logs. NEAR AI says those keys have already been revoked, which is the correct and fast move, but it’s also a reminder that logs are frequently where secrets go to die quietly until someone breaks in and finds them sitting there in plain text.
The most sensitive detail: on November 8, the attacker had a window where they could have observed requests being processed live on the compromised server, including requests made in confidential mode. NEAR AI says it found no evidence that stored Private Chat conversations or uploaded files were actually accessed, but “no evidence of access” and “confirmed no access happened” are not the same sentence, and it’s fair for affected users to want more certainty than that.
NEAR AI’s response, and its own blunt admission
NEAR AI closed off the attacker’s access, patched the SGLang vulnerability across all of its inference servers, rotated the affected credentials, revoked active sessions and admin credentials, and took the Private Chat feature fully offline. Cloud access, which had been paused during the investigation, is back up. The company says it has finished a full forensic review and completed the remaining credential rotations, and that it has contacted the affected users and the owners of the 18 compromised agents individually.
What stands out most is how directly NEAR AI owned the limits of its own security model. In its own words: “Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here.” That’s an unusually honest line for a company to put in its own incident report, and it cuts right to the thing every AI infrastructure provider leaning on confidential computing or secure enclaves needs to internalize. The enclave can be mathematically sound and still get compromised if the software running inside it has a hole in it.
NEAR AI says it’s now treating the inference software and everything running around the enclave with the same security rigor it applies to the enclave itself, and that the code, dependencies and deployment configuration for its confidential inference stack remain public so outside researchers can verify what’s actually running.
Part of a rougher few weeks for crypto-adjacent infrastructure
This breach lands in the middle of a genuinely bad stretch for security across crypto and AI infrastructure. We’ve already covered how Wyndham left a hardcoded password sitting in its app and exposed a guest database as a result, a different failure mode than NEAR AI’s but the same underlying lesson: attackers don’t need a sophisticated zero-day when there’s an easier door left unlocked. And the fallout from the Binance hack keeps compounding too, with North Korean hackers reportedly using homemade memecoins to launder funds from that breach weeks after it happened. None of these incidents are related to each other technically, but together they paint a picture of an industry where the attack surface is growing faster than the security practices meant to cover it.
For NEAR AI specifically, the SGLang angle matters beyond this one company. SGLang is used widely across the inference-serving ecosystem, so any company running it on exposed infrastructure should be checking right now whether they’re patched, not waiting for their own incident report to find out the hard way.
The bottom line
NEAR AI handled the aftermath about as well as a breach can be handled: fast patching, fast credential rotation, direct notification and a public report that doesn’t dodge the uncomfortable parts. That’s worth crediting. But the honest framing in its own report is the real story here. Confidential computing has become a selling point across AI infrastructure, the pitch that your data stays private even from the provider hosting it, and this incident is a clean demonstration of where that pitch runs out. The enclave isn’t the whole system. Everything feeding into it and sitting around it needs to be just as hardened, and right now a lot of companies making big promises about confidentiality haven’t fully internalized that yet.
The Teck Hustlers Editorial Team covers technology, business, finance and gaming news for readers who want the story behind the headline. Every article is researched, written and edited by our in-house team, checked against company announcements, filings and reputable reporting, and updated when new facts emerge. We focus on what each development means for founders, professionals, investors and everyday users. Have a tip or a correction? Reach us through our contact page.
