Key Takeaways
- An SGLang vulnerability allowed an attacker to execute code on a Near AI inference server and penetrate internal infrastructure.
- Approximately 100 user accounts and 18 legacy AI agents were affected, while two customers had API keys exposed.
- Near AI restored Cloud services after patching its servers, but acknowledged limitations in confidential computing protections.
SGLang Vulnerability Opens Door to Near AI Infrastructure
According to Near AI’s official security incident report published Monday, Nov. 9, the unauthorized party exploited a remote code execution (RCE) vulnerability in SGLang, an open-source engine used to process artificial intelligence workloads. The flaw permitted code execution on one inference server, providing an entry point into additional internal systems.
From there, the intruder reached infrastructure associated with Near AI’s previously deprecated Private Chat service, downloading account information belonging to approximately 100 users. The stolen records included names and email addresses, while certain accounts also exposed subscription plans and balance information.
The intrusion extended beyond customer records. Investigators confirmed unauthorized access to 18 agents operating on a legacy Near AI Agents deployment outside the company’s trusted execution environment (TEE). Retrieved information included chat histories, configuration settings, and operational logs.
Two Near AI Cloud customers also had application programming interface (API) keys exposed through those logs. Both credentials have since been revoked.
Importantly, Near AI reported finding no indication that stored Private Chat conversations or uploaded files were accessed. However, the company acknowledged that requests processed on the compromised server on Nov. 8 could have been observed, including requests operating in confidential mode.
The disclosure distinguishes confirmed data theft from potential exposure of information during processing. Near AI did not quantify how many confidential requests might have been observed.
Why Didn’t Confidential Computing Prevent the Breach?
Perhaps the incident’s most consequential revelation concerns the limitations of confidential computing, a technology designed to protect sensitive information through hardware-isolated execution environments. Near AI explained that these protections cannot automatically defend against vulnerabilities within the applications operating inside those environments.
“Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here,” the company acknowledged.
In practical terms, the attacker exploited the inference software itself, rather than needing to defeat the hardware isolation mechanisms. Once the malicious code executed inside the affected server, requests undergoing processing became potentially accessible.
The distinction matters because confidential computing is intended to restrict access by infrastructure operators and underlying hosts. It does not guarantee that the software handling sensitive information is free from exploitable defects. Near AI said its security analysis would now examine inference software and surrounding services with the same rigor applied to protected computing environments.
Near AI Restores Cloud Services Following Security Response
Following detection, Near AI revoked active sessions and administrative credentials, replaced agent tokens, and took Private Chat offline. Engineers deployed a fix for the SGLang vulnerability across every inference server and completed additional credential rotations.
The company also reported completing a forensic review, notifying affected users and contacting the owners of all 18 compromised AI agents individually. Near AI confirmed that cloud service access had been restored after containment and remediation. The vulnerability was additionally reported to the SGLang project.
Affected customers received instructions through security@near.ai, while the company cautioned users against unsolicited communications referencing account information or balances. Regulatory notifications will follow where legally required. The incident reportedly did not affect Near Protocol itself or other services within the broader ecosystem.
Nevertheless, the breach raises an uncomfortable question for confidential AI infrastructure providers: How private is protected computation when the software processing requests remains vulnerable? Hardware isolation offers an important security boundary, but the Near AI incident demonstrates that confidentiality ultimately depends on the integrity of the applications operating within it.
The Near AI compromise also arrives amid an extraordinary succession of security incidents documented by Bitcoin.com News over the past few months. From Binance’s staggering $6.3 billion hack on Oct. 29 and Bitget’s reported $387.5 million wallet breach to the Liquid Network exploit involving nearly 600 BTC, attackers have repeatedly exposed weaknesses across the digital asset industry.
Security incidents involving Ledger, Safepal, Trezor, Keystone, Chainalysis, Gnosis Pay, Keplr-Web3Auth, and Crédit Mutuel Arkéa have further broadened the concerns, while newly disclosed iOS vulnerabilities threaten sensitive application data. Collectively, these episodes reveal an increasingly uncomfortable reality: The industry’s security challenges extend far beyond stolen cryptocurrency, reaching deep into customer records, software dependencies, authentication systems, and the infrastructure entrusted with protecting digital assets.
