al-ice.ai

The Enclave Can’t Patch the Server: NEAR AI’s SGLang RCE Became a Cloud Breach

Agent & Supply Chain Security by al-ice.ai Editorial

On 9 November 2026, NEAR AI published a Security Incident Report describing a breach that started the day before: an unauthorized party exploited a remote code execution vulnerability in SGLang, the open-source inference engine on its servers, gained code execution on one inference server, and from there reached into company infrastructure. The confirmed toll: account details for approximately 100 users downloaded, 18 agents on a legacy deployment accessed, two Cloud API keys exposed in logs and revoked, and a window on 8 November during which the attacker could have observed requests being processed on the compromised server — including requests running in confidential mode. NEAR AI paused Cloud inference on detection, closed the access, deployed the fix fleet-wide, and restored Cloud service on 10 November. NEAR Protocol and other NEAR services were not affected.

From one inference server to the account database

The report’s attack path is short and worth tracing exactly as stated. The SGLang flaw gave the attacker code execution on a single inference server; from that foothold they reached an internal system behind the previously deprecated Private Chat service and downloaded account details — email addresses, names, and for some accounts plan and balance information — for roughly 100 users. NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed. Separately, the attacker reached 18 agents on a legacy deployment of NEAR AI Agents that were not running inside the company’s confidential-computing (TEE) environment, retrieving chat history, settings, and operational logs. Two NEAR AI Cloud customers had API keys sitting in those logs; both keys have been revoked. Notably, the report does not name a CVE for the SGLang flaw — it describes it only as an unpatched remote code execution vulnerability, since reported to the SGLang project — so there is no confirmed mapping to any previously disclosed SGLang issue.

The confidential-mode caveat, stated plainly

The most consequential sentence in the report is the one about confidential computing. NEAR AI writes that confidential computing protects data from the operator and the host, but not against a vulnerability in the software running inside the environment — and that is what happened here: the SGLang flaw let the attacker run code inside one inference server and access requests in processing on that server, including confidential ones. This is the correct mental model, stated by the party with the most incentive to soften it: the enclave held against the operator, and the threat came from inside the trust boundary the software stack itself defines. The company says it is now treating the inference software and the services around the enclave with the same rigor as the enclave itself in security analysis, and that the code, dependencies, and deployment configurations for its confidential inference stack remain public for verification. Affected users were contacted directly from security@near.ai; the 18 agent owners were contacted individually; regulatory notifications are to follow.

Response and the deprecated-service trap

On detection, NEAR AI revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, deployed the SGLang fix across all inference servers, and completed rotation of remaining credentials plus a forensic review. Two details deserve attention from defenders. First, the account-data path ran through infrastructure behind a deprecated service — Private Chat was discontinued, but its backend systems were still reachable enough to be exfiltrated from. Deprecated does not mean decommissioned, and attackers do not check product roadmaps. Second, the API keys were exposed in agent operational logs, the same log-content class that keeps recurring across agent incidents this month. Keys in logs are a standing invitation that any lateral movement redeems.

What to actually do

  1. Treat inference servers as internet-facing production with code-execution history: patch SGLang (and vLLM, Triton, and equivalents) on server-class timelines, not library-class ones, and segment inference hosts so one compromised server cannot reach account systems or agent backends. The pivot, not the RCE, is what made this a breach.
  2. Audit deprecated-but-alive backends: any discontinued chat, agent, or console product whose internal systems still hold user data or credentials should be decommissioned or isolated now, before it becomes someone else’s entry summary.
  3. Keep secrets out of agent chat history, settings, and operational logs — and assume any log store reachable from serving infrastructure will be read in the next lateral-movement chain. Scope API keys, rotate them, and alert on their use outside expected paths.
  4. Run agents that handle sensitive data inside the TEE boundary, not beside it: the 18 exposed agents were on a legacy deployment outside confidential computing, while current deployments were not listed as accessed. Legacy-agent inventory is a security control.

The pattern to file this under is inference infrastructure as the soft underbelly of AI platforms: this site’s October SGLang coverage documented an eval() RCE in the Dumper subsystem, a decoder bypass with a truncated affected range, five multimodal CVEs with no fixed version, and caller-controlled cache keys serving one tenant’s images to another — alongside unauthenticated FastLLM/SGLang flaws and cross-tenant KV-cache exposure. NEAR AI’s breach is what that catalogue looks like when it stops being a catalogue. Read with the GitBook agent-infrastructure breach the same week, the lesson is that agent platforms keep falling over the same two things: serving software with RCE and credentials where logs can reach them.

Our verification was read-only. We read NEAR AI’s Security Incident Report first-hand in full (NEAR AI Team, published 9 November 2026: 8 November exploitation of an unpatched SGLang RCE, code execution on one inference server, ~100 users’ account details via deprecated Private Chat backend, no stored conversations or files indicated as accessed, 18 legacy non-TEE agents with chat history/settings/logs, two Cloud API keys exposed in logs and revoked, possible observation of 8 November requests including confidential-mode ones, sessions and credentials revoked, Private Chat taken offline, fleet-wide fix, forensic review, direct user notification, pending regulatory notifications, TEE-scope statement, vulnerability reported to SGLang). Cloud restoration on 10 November and the X update posts are carried as reported via crypto.news (Olivia Stephanie, 10 November, quoting the company statement verbatim), PANews, Crypto Times, and Crypto Briefing. No CVE is named in the report and we map it to none. We ran no server, tested no exploit, touched no NEAR AI infrastructure, and contacted no vendor. Brave Search was used for discovery only.

Sources: