NEAR AI Breached via SGLang Flaw, Exposing About 100 Users and 18 Agents

What happened

The report says the attacker first gained code execution on one inference server, then reached an internal system tied to the retired Private Chat feature and downloaded names and email addresses for about 100 users, with subscription plan and balance details for some; chat histories, settings and logs for 18 agents on a legacy NEAR AI Agents deployment were taken, and two cloud customers' API keys appeared in logs and have been revoked. NEAR AI says it has contacted the affected users and agent owners.

The report says requests processed on the compromised server on Nov 8 could have been observed by the attacker, including requests sent in confidential mode, while stored Private Chat conversations and uploaded files show no sign of access. NEAR AI says it has patched the vulnerability, revoked all sessions and administrative credentials, replaced agent tokens and taken Private Chat offline, and cloud services are restored; the NEAR Protocol blockchain and other services were unaffected.

The report does not identify which SGLang vulnerability was used, which versions are affected, or any CVE identifier; NEAR AI says it reported the bug to the SGLang project. A separate, already-public SGLang flaw, CVE-2026-111391, exists, and NEAR AI has not confirmed whether this incident involved it. Teams running SGLang themselves currently have no version number or fixed release to check against.

Key facts

1. Timeline: The attack took place on Nov 8; NEAR AI published its security report on Nov 9 and said on X on Nov 10 that cloud services were restored
2. Entry point: A remote code execution flaw in SGLang, the open-source inference engine; the specific flaw and affected versions are not public and there is no CVE
3. Exposure: Names and email addresses for about 100 users, with plan and balance details for some; chat histories, settings and logs for 18 legacy agents; API keys for two customers
4. Confidential requests: Requests processed on the compromised server on Nov 8 could have been observed, including confidential-mode requests; stored conversations and files show no sign of access
5. Response: Patched the flaw, revoked sessions and administrative credentials, replaced agent tokens and took Private Chat offline; cloud services restored
6. Unaffected: The NEAR Protocol blockchain and other services were unaffected, with no established connection to the Binance hack