NEAR AI SGLang Security Breach Explained: 100 Users, 18 Agents and the Confidential Computing Lesson

Image: Wikimedia Commons / BalticServers, CC BY-SA 3.0 — Illustrative image: a data centre. The breach hit an inference server running SGLang, not a data-centre building.

TL;DR: On 8 November 2026, an attacker used a remote code execution flaw in SGLang, the inference engine on NEAR AI's servers, to break into one server and reach internal systems. In the NEAR AI SGLang security breach, account details for about 100 users and data from 18 AI agents were taken, and requests, including confidential-mode ones, could have been observed.

Key Highlights

• An attacker exploited a remote code execution vulnerability in SGLang on 8 November 2026, gaining code execution on one NEAR AI inference server and reaching internal systems from there.
• Account details — email addresses, names, and plan and balance information for some accounts — were downloaded for approximately 100 users, from a system behind the retired Private Chat feature.
• Data from 18 AI agents on a legacy deployment that was not running in NEAR AI's confidential computing environment was accessed, including chat history, settings and logs.
• Two NEAR AI Cloud customers had API keys exposed in logs; both keys have been revoked.
• NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed, and the NEAR Protocol blockchain was unaffected.
• The exploited flaw has no public CVE number yet — NEAR AI has not said which SGLang vulnerability was used, and has reported it to the SGLang project.

What Happened in the NEAR AI SGLang Security Breach?

NEAR AI is the AI product and infrastructure arm of the NEAR ecosystem. It runs AI models on its own servers and offers a Cloud service for developers. On 8 November 2026, an attacker exploited a remote code execution vulnerability in SGLang, the open-source inference engine NEAR AI uses to serve its models. The flaw let the attacker run code on a single inference server, and from that foothold they reached other parts of NEAR AI's infrastructure.

NEAR AI published its security incident report on 9 November 2026, and confirmed the details on X the following day. It paused NEAR AI Cloud inference operations while it investigated, then restored access once the vulnerability was fixed across all inference servers. The company says it has revoked all active sessions and administrative credentials, replaced all agent tokens, taken Private Chat offline, completed a full forensic review and finished rotating the remaining credentials.

Date	What happened
8 November 2026	Attacker exploits the SGLang remote code execution flaw on one NEAR AI inference server and reaches internal systems. Requests being processed on that server — including confidential-mode requests — could have been observed.
9 November 2026	NEAR AI publishes its security incident report (12:00 UTC). Cloud inference is paused during the investigation.
10 November 2026	NEAR AI confirms the breach on X; The Block, Decrypt and crypto.news report it. The fix is deployed across all inference servers and Cloud access is restored.

What Data Was Taken?

The damage was limited, but it was real. NEAR AI's investigation confirmed that the attacker reached an internal system behind Private Chat, a feature the company had already retired, and downloaded account details for approximately 100 users. Separately, the attacker accessed 18 agents on a legacy deployment of NEAR AI Agents that was not running in the company's confidential computing environment.

What was accessed	Detail
About 100 user accounts	Email addresses and names; plan and balance information for some accounts. Taken from a system behind the deprecated Private Chat feature.
18 legacy AI agents	Chat history, settings and logs. These agents ran on an older deployment outside NEAR AI's confidential computing (TEE) environment.
Two Cloud customers	NEAR AI Cloud API keys exposed in logs. Both keys have been revoked.
Requests in flight on 8 November	Could have been observed while being processed on the compromised server, including requests running in confidential mode.
Not accessed, per NEAR AI	No indication that stored Private Chat conversations or uploaded files were accessed.

NEAR AI has contacted the affected users directly from security@near.ai with the steps that apply to them, and the 18 agent owners individually. It says it will make any regulatory notifications that are required. Its own advice to everyone else is to treat unsolicited messages referencing your account or balance with caution — exactly the kind of phishing that follows a breach in which email addresses leak.

What Is SGLang?

SGLang is an open-source inference engine — the software that takes a large language model and serves its responses to users. Inference engines sit between the model and the application: they schedule requests, manage memory and run the model on GPUs. When such an engine has a remote code execution flaw, an attacker who can reach it may be able to run their own code on the server hosting the model — which is what happened here.

SGLang was in the news the same week for a different reason: xAI said its upcoming Grok 4.8 release date explained update involves dumping JAX and SGLang for a from-scratch C/C++ stack. The two stories are separate — one is a product decision, the other is a security incident — but together they show how central this one open-source component has become to AI infrastructure.

The SGLang Flaw: What Is Known — and What Is Not

The most important gap in this story is the flaw itself. NEAR AI has not published a CVE number, a fixed version or the exploit mechanism, and the specific vulnerability it patched has not been publicly identified. It has reported the vulnerability to the SGLang project, which is the correct route — but until a public advisory lands, other SGLang operators cannot check whether they were exposed to the same bug.

What is known is that SGLang has had security problems before. Earlier in 2026, Carnegie Mellon University's CERT Coordination Center published advisories documenting multiple vulnerabilities in the project, including remote code execution flaws. One later flaw, CVE-2026-93034, was published on 8 October 2026, rated 9.8 out of 10, and describes arbitrary code execution in SGLang's internal messaging, with a partial fix landing on 20 October. It would be wrong to assume that was the flaw in this breach: NEAR AI has not linked the incident to any earlier disclosure, and Decrypt notes there is no basis to do so. Treat CVE-2026-93034 as context about the project's security history, not as the cause of this incident.

Image: Wikimedia Commons, CC BY-SA 4.0 — Illustrative image: server racks in a data centre.

Why Confidential Computing Did Not Stop the Breach

This is the part of the story that matters most, because NEAR AI markets confidential inference as a privacy guarantee. The company runs some of its inference inside hardware-protected enclaves — trusted execution environments (TEEs) — which are designed so that not even the operator or the host can see the data being processed. The breach showed the limit of that guarantee, in NEAR AI's own words:

"Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here: the SGLang vulnerability let the party run code inside one inference server and access requests in processing on that server, including confidential ones."

In plain terms: the enclave protects data from outsiders looking in, but it cannot protect data from a bug in the software running inside it. The attacker did not break the enclave; they used a flaw in SGLang to run code inside the server, and from there they could see requests as they were being processed. The 18 agents that were accessed were not even in the TEE — they ran on a legacy deployment outside it.

NEAR AI says it is now treating "the inference software and the services around the enclave with the same rigor as the enclave itself" when running security analysis, and that the code, dependencies and deployment configurations for its confidential inference stack remain public so anyone can verify what is running. That is the right response — and a useful rule for anyone building on confidential computing: the trust boundary is the whole software stack, not just the hardware.

What It Means for Indian Users and AI Developers

No India-specific impact has been announced, and the roughly 100 affected users were contacted individually, so most Indian readers will not be directly affected. The practical lesson lands closer to home for Indian developers: SGLang is a popular way to serve open models, and many Indian startups and research teams run it on their own servers. If you do, keep it updated, do not expose an inference server directly to the internet, and treat the inference engine as part of your security boundary — not as a trusted black box behind it.

The disclosure also came in a noisy week for NEAR. Elliptic reported on 9 November that attackers created six temporary memecoins and used decentralised liquidity pools to move about $430,000 in funds associated with the Binance exchange hack through NEAR-based tokens. NEAR AI says it has established no connection between that and its own breach — the two events should not be conflated.

For the wider pattern, this is the second AI-infrastructure breach in a week: the Fireworks AI data breach exposed customer billing data and model weights days earlier. AI companies are now holding the same kind of sensitive data — and running the same kind of internet-facing infrastructure — that traditional tech companies have been breached through for years.

Should You Care?

✅ Yes, if you use NEAR AI or run SGLang — otherwise, take the lesson. NEAR AI Cloud users should check for an email from security@near.ai and follow its steps if they were contacted; if you run SGLang yourself, update it and make sure the server is not directly exposed. For everyone else, the takeaway is structural: a hardware enclave does not patch a software bug, and confidential computing is only as strong as the code running inside it.

What to Do if You Use NEAR AI

1. Check your email. Affected users were contacted from security@near.ai. If you have not heard from NEAR AI, the company says no action is needed.
2. Follow the steps in that email if you were contacted. Do not follow instructions from any other message claiming to be about this breach.
3. Rotate Cloud API keys if you use NEAR AI Cloud, especially if your keys appear in logs you share or store.
4. Watch for phishing. Email addresses leaked in this breach can be used for targeted messages about your account or balance — NEAR AI itself warns users to treat such messages with caution.
5. If you run SGLang anywhere else, patch and isolate. Keep the engine updated and behind authentication, and watch the project's advisories for the public disclosure of the flaw NEAR AI reported. CISA's CISA KEV November 2026 list is the patch-now queue for flaws confirmed to be exploited in the wild.

FAQs

What is SGLang?
SGLang is an open-source inference engine used to serve large language models — the software that runs a model on a server and generates responses to user requests. NEAR AI uses it on its inference servers, as do many other AI companies and developers.

What happened in the NEAR AI breach?
On 8 November 2026, an attacker exploited a remote code execution vulnerability in SGLang to run code on one NEAR AI inference server, then reached internal systems. Account details for about 100 users and data from 18 legacy AI agents were accessed, and requests processed that day — including confidential-mode ones — could have been observed. NEAR AI published its incident report on 9 November and says the flaw is fixed and Cloud access restored.

Was the NEAR Protocol blockchain affected?
No. NEAR AI says the NEAR Protocol blockchain and other services in the NEAR ecosystem were unaffected. The breach was limited to NEAR AI's own infrastructure — its inference servers, a system behind the retired Private Chat feature, and a legacy agents deployment.

What should NEAR AI users do now?
If NEAR AI contacted you from security@near.ai, follow the steps in that email. If you were not contacted, the company says no action is needed. Cloud users should still rotate API keys as a precaution, and everyone should treat unsolicited messages about their account or balance with caution, since leaked email addresses are commonly used for phishing.

Takeaway

The NEAR AI breach is small in scale — about 100 users — but large in implication: it shows that confidential computing protects data from the host, not from a vulnerability in the software inside the enclave. For AI companies, the inference engine is now part of the trust boundary, and it has to be patched and audited like one.

If you serve models with SGLang, check your deployment is on a patched version and not exposed directly to the internet — and if you want the wider pattern, read how the Fireworks AI data breach exposed billing data and model weights in the same week.

Sources

• NEAR AI — Security Incident Report: SGLang Vulnerability (9 November 2026, primary source)
• The Block — NEAR AI says SGLang vulnerability exposed user account details in security breach (10 November 2026)
• Decrypt — Near AI Breach Exposes User Details and Data From 18 AI Agents (10 November 2026)
• crypto.news — NEAR AI fixes SGLang security flaw, restores Cloud service (10 November 2026)
• AI Secure Platform — NEAR AI Breach via SGLang Flaw Exposed 100 Users and 18 Agents Despite Enclaves (10 November 2026; CVE-2026-93034 context)