On November 8, an attacker used a remote code execution flaw in SGLang, the open-source inference engine running on NEAR AI servers, to gain code execution on one inference server and move into the wider infrastructure.

From there, the attacker reached an internal system behind the deprecated Private Chat and downloaded account details (email, name and, for some accounts, plan and balance) for approximately 100 users. Access also covered 18 agents on a legacy NEAR AI Agents deployment outside the TEE environment, including their chat history, settings and logs. Two Cloud customers had API keys exposed in logs; those keys were revoked.

Requests processed on the compromised server on November 8 could have been observed, including ones running in confidential mode.

NEAR AI revoked sessions and admin credentials, took Private Chat offline, patched SGLang across all inference servers and contacted affected users. The case shows that confidential computing protects data from the host, but not from bugs in the software running inside the enclave.