A bug in NEAR AI's inference engine let an attacker into 18 AI agents and about 100 accounts

NEAR AI sells private, confidential AI: inference that runs inside hardware-isolated enclaves so that even the operator can't peek. On 9 November it found someone inside its infrastructure anyway, and paused NEAR AI Cloud while it worked out how far they got.

What happened

According to the company's incident report, the attacker exploited a remote code execution vulnerability in SGLang, the open-source inference engine running on its servers. That gave them code execution on one inference server, and from there access to wider infrastructure. They reached an internal system behind the company's previously deprecated Private Chat product and downloaded account details for roughly 100 users: email addresses, names and, for some, plan and balance information.

The agents

The attacker also got into 18 agents on a legacy deployment of NEAR AI Agents that were not running inside the confidential computing environment. From those agents they retrieved chat history, settings and logs. Two cloud customers had NEAR AI Cloud API keys sitting in those logs; both keys have been revoked. The company says that on 8 November the attacker could also have watched user requests being processed on the compromised server, including requests running in confidential mode. It found no sign that stored Private Chat conversations or uploaded files were accessed.

What NEAR AI did

It revoked all active sessions and admin credentials, replaced every agent token, took Private Chat offline, patched the SGLang bug on all inference servers, rotated the remaining credentials and completed a forensic review. The cloud service was back online on 10 November, and the company says NEAR Protocol and its other services were not affected. Users whose details or agents were accessed have been notified, and the bug has been reported to the SGLang project.

Our take

This one comes with an honest admission from the company itself: an enclave protects data from the host, not from a bug in the software running inside it. Agents make it worse, because their logs quietly collect everything, including API keys. Keep secrets out of agent logs, retire legacy agent deployments instead of leaving them running, and patch the inference stack as seriously as the enclave around it.