0x626c8fb5626c…626c8fb2
NEAR AI Attributes Security Breach to SGLang Inference Engine Flaw
NEAR AI says a Nov. 8 exploit of the SGLang inference engine gave an attacker partial access to internal infrastructure; cloud service remains paused pending security confirmation.
Outputs
An attacker exploited an SGLang vulnerability on Nov. 8 to access part of NEAR AI's internal infrastructure
NEAR AI blocked the access and fixed the vulnerability
NEAR AI Cloud remains paused pending security confirmation
All affected users were notified; users without a notice need take no action
NEAR Protocol's mainnet and other services were unaffected
NEAR AI has confirmed that an attacker exploited a vulnerability in SGLang, the AI inference engine underlying its stack, on Nov. 8 and gained unauthorized access to part of the company's internal infrastructure. The company disclosed the intrusion in a security update, stating it blocked the attacker's access and patched the flaw, while NEAR AI Cloud remains paused until the company confirms its systems are secure.
The Nov. 8 date anchors the timeline. NEAR AI first suspended cloud inference after discovering unauthorized system access; the latest update adds detail by naming SGLang as the reported entry point. The disclosure does not explain how far the intrusion extended into internal systems, nor does it say whether user data was accessed.
What does the incident change for practitioners?
The immediate operational consequence is service availability. NEAR AI Cloud is offline, and the company has set restoration against a single condition: confirmation that its systems are secure. There is no published date for that confirmation, which leaves customers running inference workloads on the platform without a recovery window.
The company said it notified all users affected by the incident. Users who did not receive a notice, according to NEAR AI, do not need to take action. That notification split effectively defines the blast radius from the customer's side — silence now functions as a signal of non-exposure, at least as far as the company's assessment goes.
NEAR AI also stated that the intrusion did not affect NEAR Protocol's mainnet or its other services. The separation matters for anyone conflating the AI subsidiary's infrastructure with the layer-1 blockchain itself. On-chain operations continued without reported impact; the incident was confined to the AI inference layer.
Why the SGLang detail carries weight
Naming the vulnerable component distinguishes this incident from a generic breach disclosure. SGLang is the inference engine NEAR AI uses to serve AI workloads, which places the entry point at the software layer closest to compute delivery. An exploit at the inference engine means the attack path ran through the core service the company sells, not through a peripheral system such as a marketing portal or third-party vendor.
The company's remediation statement covers two actions: blocking the attacker's access and fixing the vulnerability. What remains unaddressed in the update is scope. No figure has been published for the number of affected users, the duration of the intrusion before detection, or the categories of data, if any, that the attacker reached. That absence leaves the disclosure lighter than the incident's implications suggest.
For teams building on AI inference infrastructure generally, the episode illustrates a dependency risk. When a platform's serving layer depends on an external open-source engine, a vulnerability in that engine becomes a vulnerability in every downstream service. The pause at NEAR AI Cloud demonstrates how quickly that risk converts into downtime once exploited.
What happens next
NEAR AI says it will restore cloud service after reaching security confirmation. Until then, the service stays dark, affected users work from the notices they received, and the two open questions — the depth of the intrusion and whether user data was accessed — await further disclosure from the company.
via tokenpost.com (Source)
More from Nathan Brooks
Show full bio
Market editor covering money, funding and market shifts around crypto and web3 industry at Mempool Brief.
959 articles