NEAR AI breach: SGLang RCE hits 18 legacy agents and ~100 user accounts

NEAR AI disclosed on November 9 that an attacker chained a remote code execution flaw in SGLang — the open-source inference engine it runs — from a single inference server into internal systems tied to its deprecated Private Chat product. Details come from NEAR AI's own incident report, confirmed by The Block and Decrypt. Account data for roughly 100 users was exposed; data from 18 legacy agents was read; two NEAR AI Cloud API keys were pulled and have been revoked.

What happened

Per NEAR AI's report, the attacker used an SGLang RCE bug to execute commands on one inference server, then pivoted to an internal system linked to Private Chat, a feature that had already been retired. From that pivot they reached a legacy deployment of NEAR AI Agents that sat outside NEAR AI's confidential computing (TEE) environment.

What was exposed:

• Account records for ~100 users: email, name, and for some accounts, subscription plan and balance.
• Chat history, settings and logs for 18 agents running on the legacy (non-TEE) deployment.
• Two NEAR AI Cloud API keys, now revoked. NEAR AI has not said whether the attacker used them before revocation.
• Confidential-mode requests processed on November 8 may have been visible in-flight, though stored Private Chat conversations and uploaded files were not accessed, according to the report.

NEAR AI's statement, as quoted by Decrypt: "On detection, we revoked all active sessions and administrative credentials." The company also replaced agent tokens, took Private Chat offline, and pushed an SGLang patch across every inference server.

The SGLang leg

The incident sits in the AI-inference stack, not on the NEAR Protocol blockchain. NEAR AI did not identify which specific SGLang vulnerability was exploited and explicitly said it is not tying the incident to the six SGLang issues CERT documented in July. For operators running SGLang in production, the practical read is that NEAR AI treats it as a separate, unpatched-at-the-time bug and recommends updating.

The report does not report any on-chain fund movement, any loss of NEAR tokens, or any effect on NEAR Protocol validators or RPC infrastructure. That separation — the AI product plane versus the blockchain plane — is central to how NEAR AI is framing scope.

Why the "legacy agents" line matters

The 18 affected agents were running on an older NEAR AI Agents deployment that pre-dated the current confidential-compute default. Agents inside NEAR AI's TEE path are structurally not in the same blast radius. That is both the honest technical story and the operational lesson: products that advertise TEE isolation inherit the full risk of any non-TEE component they share infrastructure with. Private Chat had already been deprecated, but its backend was reachable, which is what let the inference-server RCE reach data from 18 other agents.

Impact and response

Concrete steps NEAR AI said it has taken:

• Revoked all active sessions and admin credentials.
• Replaced tokens for the 18 affected agents.
• Shut down Private Chat.
• Patched SGLang across every inference server and restored Cloud service.
• Contacted the owners of the 18 agents and the ~100 affected account holders directly.
• Published the incident report and committed to any required regulatory notifications.

The incident response is tight by industry standards for AI-inference breaches: detection, patch, disclosure and notification inside a week. The remaining open items are the specific SGLang CVE (or unpublished bug class), the full list of 18 agents and their operators, and whether the revoked API keys were used against NEAR AI Cloud customers before revocation.

Context

AI-inference-engine compromises hit a different user base than wallet breaches, but they land on the same critical surface: keys and request context. A thematically related incident — Cloudflare's October 2026 disclosure of a cross-request KV-cache exposure in SGLang on Workers AI — showed that SGLang's tenant-isolation footprint is the current weak link across multiple serving platforms. NEAR AI's breach is a different bug (RCE, not cache crossover) but the same engine, which is why the SGLang patch cadence matters to operators far outside the NEAR ecosystem.

What to watch

1. The specific SGLang bug. NEAR AI declined to name it. If and when the bug ships a CVE, every operator running an older SGLang build needs to patch.
2. Whether the two exposed API keys were used. NEAR AI said they were revoked, not that they were unused. A subsequent update on Cloud customer traffic is the clean way to close that question.
3. Scope of in-flight confidential-mode exposure on Nov 8. The report flags it; the duration window and the number of affected requests have not been disclosed.
4. Downstream agent operators. Owners of the 18 agents were contacted; whether any choose to publish their own post-mortems will determine how much of the attack chain becomes public.