NEAR AI, the AI product and infrastructure arm of the NEAR Protocol ecosystem, has contained a security breach after an attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine running on its servers.
According to the incident report published on Monday, the attacker gained code execution on one inference server and reached an internal system behind a previously deprecated Private Chat feature. The attacker downloaded account details—including email addresses, names, and in some cases plan and balance information—for approximately 100 users. An additional 18 agents on a legacy NEAR AI Agents deployment outside the confidential computing environment were accessed, exposing chat history, settings, and logs. Two NEAR AI Cloud customers had API keys exposed in logs; those keys have since been revoked.
On Nov. 8, the attacker could have observed user requests being processed on the compromised server, including requests running in confidential mode. NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed. The company explained that 'Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here.' The SGLang vulnerability allowed code execution inside an inference server and access to requests being processed there, including confidential ones.
In response, NEAR AI closed the access path, replaced affected credentials, and patched the vulnerability across all inference servers. Access to NEAR AI Cloud, which was paused during the investigation, has been restored. The team also revoked active sessions and administrative credentials, rotated agent tokens, took Private Chat offline, completed a forensic review, and contacted affected users and agent owners individually. NEAR AI said it reported the vulnerability to SGLang and will apply stricter security analysis around its enclaves.
At the time of reporting, NEAR traded near $3.60 on CoinMarketCap, up 2.8% over 24 hours. The market snapshot shows no immediate token-price collapse tied to the disclosure, though that should not be treated as proof of no market impact. The incident arrives as NEAR continues to expand its AI-linked infrastructure, and follows earlier security work across the ecosystem, including the NEAR Intents exploit recovery.
