NEAR AI has confirmed a security breach that exposed account information belonging to approximately 100 users and compromised data from 18 AI agents after an attacker exploited a remote code execution vulnerability in its SGLang inference infrastructure.
The incident, disclosed in a November 9, 2026 security report, also exposed API keys belonging to two NEAR AI Cloud customers and may have allowed the attacker to observe confidential AI requests being processed on November 8.
NEAR AI said it has contained the intrusion, patched the vulnerability across its inference servers and restored Cloud services following a temporary suspension. The company maintains that NEAR Protocol and other services in the blockchain ecosystem were unaffected.
Attacker exploited SGLang to reach internal systems
According to NEAR AI’s incident report, the attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine used to serve large language models.
The vulnerability allowed the unauthorized party to execute code on one inference server and subsequently access other internal systems.
The attacker first compromised a single server, but the access did not stay there.
Investigators established that the attacker reached an internal system associated with NEAR AI’s previously deprecated Private Chat feature and downloaded account information for approximately 100 users.
The compromised information included names and email addresses, with subscription plans and balance details also exposed for some accounts.
The attacker additionally accessed 18 AI agents hosted on a legacy deployment of NEAR AI Agents. Those agents were not operating inside the trusted execution environment used by the company’s confidential computing infrastructure.
For those agents, the retrieved information included chat histories, configuration settings and operational logs. Two NEAR AI Cloud customers also had API keys exposed through those logs, although the company said both credentials have since been revoked.
The exact technical weakness exploited in SGLang has not been publicly identified by a CVE number.
Earlier vulnerabilities in the same inference framework provide some technical context. In May 2026, Carnegie Mellon University’s CERT Coordination Center published a security advisory documenting three SGLang vulnerabilities, including two remote code execution flaws and an arbitrary file-write issue.
Those vulnerabilities involved weaknesses in multimodal inference components, including unsafe deserialization of untrusted data. CERT warned that exposed service interfaces could allow unauthorized code execution on affected systems.
NEAR AI has not established whether its November incident involved any of those previously disclosed vulnerabilities or a seperate weakness. The specific entry point, affected software version and exploit mechanism remain undisclosed.
Confidential AI requests may have been exposed
Beyond the confirmed data retrieval, NEAR AI acknowledged that the attacker could have observed user requests processed on the compromised inference server on November 8, including requests running in confidential mode.
NEAR AI Cloud uses trusted execution environments, or TEEs, to isolate sensitive AI workloads from the underlying host infrastructure. The technology is designed to prevent infrastructure operators and unauthorized host-level processes from accessing protected data during computation.
But the attacker was executing code inside the inference environment itself, which is a different problem.
NEAR AI acknowledged that confidential computing cannot protect data from vulnerabilities in software running within the protected environment.
The SGLang flaw allowed the attacker to execute code on an inference server where confidential requests were being processed, potentially exposing information while it was actively handled by the model.
The company has not established that the attacker actually captured individual confidential prompts or identified the number of requests potentially observable during the intrusion.
It also found no indication that stored Private Chat conversations or uploaded files had been accessed.
Those findings concern different datasets. The attacker retrieved historical conversations belonging to 18 legacy agents, while the possible exposure of confidential-mode requests concerns live inference activity on the compromised server.
The legacy agents were outside the confidential computing environment altogether. Their exposure therefore does not establish that the attacker extracted stored information from protected enclaves.
The incident nevertheless identifies a limitation in the privacy assurances associated with confidential inference: hardware isolation does not eliminate vulnerabilities in the applications processing the data.
NEAR AI restores Cloud access and replaces credentials
NEAR AI temporarily suspended Cloud inference services while investigating the intrusion and securing the affected infrastructure.
The company said it revoked all active sessions and administrative credentials, replaced agent tokens and deployed a fix for the SGLang vulnerability across every inference server.
It also took Private Chat offline, completed its remaining credential rotations and conducted a forensic review of the incident.
Cloud access was restored after those measures were implemented.
The company said it has reported the vulnerability to the SGLang project and is applying additional security scrutiny to the inference software and services surrounding its confidential computing environments.
It intends to keep the code, dependencies and deployment configurations for its confidential inference stack publicly available for verification.
NEAR AI has contacted users whose account information or agents were confirmed to have been accessed, including the owners of all 18 affected agents. The company said it would make any regulatory notifications required by applicable rules.
The account data was downloaded, and it cannot be taken back by simply fixing the server.
NEAR AI has advised customers to be cautious about unsolicited communications referencing account information or balances, which could be used to make fraudulent messages appear legitimate.
Similar exposure of customer information has produced secondary phishing campaigns elsewhere in the cryptocurrency industry. In September, a Brevo security breach affecting 138 customer accounts allowed attackers to distribute fraudulent communications through infrastructure used by cryptocurrency businesses, including Trezor, BitBox and CoinTracking.
There is no disclosed evidence that NEAR AI customer information has been used in a comparable phishing operation. The company’s warning reflects the possibility of misuse of information already confirmed as downloaded.
NEAR blockchain unaffected by AI infrastructure breach
The breach affected NEAR AI’s model-serving infrastructure and legacy agent environment, rather than the blockchain’s underlying transaction-processing systems.
NEAR AI has repeatedly said that NEAR Protocol and other services in the ecosystem were unaffected.
That scope is relevent for NEAR token holders because NEAR AI’s operational infrastructure is distinct from the blockchain’s consensus and asset-transfer systems.
There has been no confirmed unauthorized movement of NEAR tokens or disruption to blockchain consensus attributed to the SGLang incident.
The ecosystem has experienced unrelated security incidents. In October, a NEAR Intents exploit involving approximately $3.8 million affected cross-chain infrastructure before the project reported that the stolen assets had been returned.
That earlier incident involved different systems and provides no evidence of a connection to the NEAR AI intrusion.
For Cloud customers, the immediate consequences are more specific: temporary inference-service interruption, exposure of account records, compromised legacy agent data and the replacement of affected API credentials.
Another recent example of how infrastructure boundaries influence breach exposure was the Bithumb employee-data breach in October, which involved internal workplace systems while the exchange said its cryptocurrency trading infrastructure remained unaffected.
NEAR AI’s case involves a more technically unusual attack path because the initial vulnerability sat within the software responsible for processing AI requests, including confidential workloads.
The company has recieved confirmation of which accounts and legacy agents were accessed, according to its investigation, but the public report leaves several details unresolved.
It has not disclosed the attacker’s identity, the complete period of unauthorized access, the CVE associated with the exploited SGLang flaw or how many confidential requests may have been observed.
The company also has not disclosed whether the attack involved an existing vulnerability in SGLang or a previously unknown weakness.
The vulnerability is now patched across NEAR AI’s infrastructure, and Cloud services are operational again. What remains uncertain is how far the attacker could see into the requests being handled on November 8.
For businesses relying on confidential AI processing, that unanswered exposure is more consequential than the temporary service interruption. NEAR AI’s investigation confirms that the protected computing environment was not sufficient to prevent an attacker exploiting the inference software from reaching sensitive data.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.