An attacker ran code on one of NEAR AI’s inference servers last Sunday, and in doing so downloaded data from 18 AI agents and account details for about 100 users, the company said.
SGLang remote code execution reached an inference server inside a TEE
NEAR AI reported that the attacker exploited a remote code execution (RCE) flaw in SGLang, an open-source inference engine, and executed code on one of its inference servers. That server processed requests in confidential mode inside a trusted execution environment (TEE). NEAR AI warned that the TEE "does not protect against a vulnerability in the software running inside the environment," and said SGLang runs inside the TEE — which is how the attacker could reach requests processed there.
What the attacker accessed: Private Chat account details and 18 agents
The company says the intruder moved from the compromised inference server into an internal system behind Private Chat, a product NEAR AI had already deprecated. From that system the attacker downloaded account details for about 100 users: email addresses and names, and for some accounts, plan and balance information. NEAR AI found no sign that stored Private Chat conversations or uploaded files were accessed.
Separately, the attacker reached 18 AI agents on an older deployment of NEAR AI Agents that did not run inside the company's TEE. From those agents the attacker took data including chat history, settings and logs. Two customers’ NEAR AI Cloud API keys were exposed in logs; NEAR AI has revoked both keys.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildNEAR AI’s remediation steps and communications
After detecting the attack, NEAR AI took multiple containment steps. The company revoked all active sessions and administrator credentials, replaced all agent tokens, took Private Chat offline, deployed a fix for the SGLang flaw on all of its inference servers, rotated remaining credentials, and completed a full forensic review. Access to the NEAR AI Cloud service has been restored, NEAR AI reported.
NEAR AI said it reported the flaw to the SGLang project. The company has contacted users whose account details or agents it confirmed were accessed; affected users received direct messages from security@near.ai listing the steps that apply to them. As a precaution, NEAR AI asked users to be careful with messages about their account or balance that they did not request. NEAR AI also said users who have not heard from it do not need to do anything.
NEAR AI has not identified the flaw by CVE number, has not named the affected SGLang versions, and has not said whether the SGLang project has released a fix.
Brave’s Leo assistant and chats run in a NEAR AI-operated TEE
In an October 15 technical write-up, Brave — the browser maker — said its Leo assistant runs chats with the GLM 5.3 Flash model inside a TEE operated by NEAR AI. NEAR AI has not said whether the affected inference server handled any of those chats.
What this means for technologists, vendors using NEAR AI TEEs, and affected users
- Technologists and security teams: the incident illustrates that a TEE can preserve confidentiality at the hardware level yet still be undermined by vulnerable software running inside it. NEAR AI deployed a SGLang fix across its inference servers and reported the flaw to the SGLang project; teams that run SGLang should track that project’s response and any published fixes or advisories.
- Vendors and services using NEAR AI TEEs (for example, those who run assistants or models inside NEAR AI-operated TEEs): these customers will need to confirm whether their workloads were processed on the affected server and follow any outreach from NEAR AI. Brave has documented that Leo runs GLM 5.3 Flash inside a NEAR AI TEE; NEAR AI has not said whether those chats were affected.
- Affected end users: NEAR AI has contacted users whose account details or agents it confirmed were accessed and advised caution around unexpected account- or balance-related messages. For users who were contacted, follow the guidance from security@near.ai; NEAR AI says users who have not heard from it do not need to take action.
The immediate intrusion has been closed: NEAR AI rotated credentials, revoked keys and sessions, took Private Chat offline, and restored NEAR AI Cloud access. The company also reported the SGLang flaw to the project that maintains the engine. What remains clear from NEAR AI’s account is that the compromise was enabled by a software vulnerability running inside a TEE — a fact the company highlighted when it said a TEE "does not protect against a vulnerability in the software running inside the environment." NEAR AI has not published a CVE number, listed affected SGLang versions, or confirmed whether chats run for external services (including Brave’s Leo) were processed on the compromised server.
