NEAR AI disclosed that an attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine to break into its infrastructure, exposing records for about 100 Private Chat users and data from 18 AI agents.
The company says there is no evidence that Private Chat conversations or uploaded files were accessed. The SGLang flaw has no CVE identifier yet.
How the SGLang Flaw Opened Internal Systems at NEAR AI
According to NEAR AI’s notice, the attacker used the SGLang remote code execution bug to penetrate an inference server running inside a trusted execution environment. From that foothold, the attacker reached internal systems behind Private Chat, a product the company had already deprecated.
Trusted execution environments are designed to isolate sensitive workloads, so a code execution flaw in the inference engine inside one is notable. The incident shows that the software running within a protected enclave can itself provide the entry point, regardless of the isolation around it.
What Data the Attacker Reached
NEAR AI says the attacker accessed about 100 user records containing emails, names and some plan or balance information. The attacker also reached 18 AI agents on an older deployment, including chat history, settings and logs. Two customers’ NEAR AI Cloud API keys were exposed in logs.
The count is small by the standards of large breaches. The exposure of API keys in logs is the detail most likely to matter operationally, since an exposed key can allow use of a customer’s account until it is revoked.
NEAR AI’s Containment and Remediation Steps
NEAR AI reports that it revoked sessions and admin credentials, replaced agent tokens and took Private Chat offline. It deployed a fix for the SGLang issue, rotated credentials and revoked both exposed API keys. The company reported the vulnerability to the SGLang project and contacted affected users.
The company’s notice does not describe any impact on Brave Leo, and the available reporting contains no statement on that point from either company.
Why Inference-Engine Bugs Are Becoming Breach Paths
Inference engines like SGLang sit between model weights and the network, processing requests that arrive from users and applications. A vulnerability that allows code execution in that layer gives an attacker the same position as the service itself, including access to whatever logs, tokens and credentials the process can see.
The NEAR AI case involves a modest number of users, but it fits a developing pattern in which the tooling used to serve AI models becomes a target in its own right. Security teams that have focused on prompt-level risks may need to give the underlying serving software the same patching discipline as any internet-facing application.
Open Questions About the SGLang Vulnerability
The SGLang flaw lacks a CVE number at this stage, which makes tracking it harder for organizations running the engine in their own environments. The project has been notified, and NEAR AI says it deployed a fix, but the reporting does not specify which SGLang versions are affected or when a public patch will be available.
Organizations that run SGLang should watch the project’s channels for advisory details. Until a CVE and affected-version range are published, the sensible interim step is to review exposure of SGLang servers and to check whether logs contain secrets such as API keys, the weakness that turned this breach into a credential exposure for two NEAR AI Cloud customers.
What the NEAR AI Incident Leaves Unanswered
NEAR AI has not stated how long the attacker had access before detection, and the available account does not give an exact date for the intrusion. The company disclosed the incident on November 10. The details that are known include the entry through the SGLang flaw, the scope of the exposed records, and the remediation steps taken.
The account separates what the company found from what it did not: no evidence of access to Private Chat conversations or uploaded files, but confirmed access to user records, agent data and logs. That distinction matters for the roughly 100 affected users, whose emails and names were among the exposed fields, and for the two customers who needed to replace API keys.
