An attacker exploited a remote code execution flaw in SGLang, an open-source inference engine, and ran code on one of NEAR AI’s inference servers last Sunday.
The attacker could also have seen requests being processed on that server that day, including requests sent in confidential mode, the company said earlier this week. That mode processes requests inside a trusted execution environment (TEE) designed to keep them private even from the company itself.
But the TEE “does not protect against a vulnerability in the software running inside the environment,” the company said. SGLang runs inside the TEE, which is how the attacker could reach requests there.
That access has since been closed, but not before the attacker moved further into the company’s systems.
The attacker reached an internal system behind Private Chat, a product the company had already deprecated. So far, the company has confirmed that the attacker downloaded account details for about 100 users there. These are email addresses and names, and for some accounts, plan and balance information.
The company found no sign that stored Private Chat conversations or uploaded files were accessed.
The attacker also reached 18 AI agents on an older deployment of NEAR AI Agents that did not run inside the company’s TEE. From those agents, the attacker took data including chat history, settings and logs.
Two customers’ NEAR AI Cloud API keys were exposed in logs. The company has revoked both.
After detecting the attack, the company revoked all active sessions and administrator credentials, replaced all agent tokens and took Private Chat offline. It also deployed a fix for the SGLang flaw on all of its inference servers, rotated its remaining credentials and completed a full forensic review, according to its incident report.
Access to its NEAR AI Cloud service has been restored. The company reported the flaw to the SGLang project. It has not identified the flaw by CVE number, named the affected SGLang versions, or said whether the project has released a fix.
The company has contacted users whose account details or agents it confirmed were accessed. Affected users heard directly from security@near.ai, with the steps that apply to them. As a precaution, the company asks users to be careful with messages about their account or balance that they did not ask for.
In a follow-up post yesterday, it said users who have not heard from it do not need to do anything. It has not said whether people whose requests passed through the affected server last Sunday were among those contacted.
In an October 15 technical write-up, Brave, the browser maker, said its Leo assistant runs chats with the GLM 5.3 Flash model inside a TEE operated by NEAR AI.
NEAR AI has not said whether the affected server handled any of those chats.
