NEAR AI Restores Cloud Service After SGLang Exploit Exposed 100 Users

NEAR AI has restored its Cloud inference service after an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, exposing account information belonging to roughly 100 users and compromising 18 legacy AI agents on November 8.

The company disclosed the incident in a security report published November 9. NEAR AI said it has fixed the vulnerability, replaced affected credentials, and completed a full forensic review. The underlying NEAR Protocol blockchain and other NEAR services were not affected, according to the report.

How did the attacker get in?

The breach began when the unauthorized party exploited the SGLang flaw to execute code on one inference server, then moved into other parts of NEAR AI's infrastructure. From there, the attacker reached an internal system tied to the company's previously discontinued Private Chat service and downloaded account records for approximately 100 users.

The exposed data included email addresses and names, and for some users, subscription plan and account balance details. Investigators found no evidence that stored Private Chat conversations or uploaded files were accessed.

The attacker also confirmed access to 18 agents running on an older version of NEAR AI Agents. Those deployments sat outside the company's trusted execution environment, or TEE, the hardware-based isolation layer NEAR AI uses for confidential computing. The attacker retrieved chat histories, configuration settings, and operational logs from those agents.

Two NEAR AI Cloud customers had API keys exposed through the logs. The company revoked both credentials. Investigators also established the attacker could have observed requests processed on the compromised inference server on November 8, including requests running in confidential mode. The report did not specify how many requests were observed.

What did the response involve?

NEAR AI suspended Cloud inference operations immediately after detecting the unauthorized access. Once engineers confirmed the attacker's access was closed, the company kept Cloud offline while it finished security work.

The remediation included:

• Revoking active sessions and administrative credentials
• Replacing agent tokens
• Taking Private Chat offline entirely
• Deploying the SGLang security fix across all inference servers before completing the remaining credential rotations

The company has contacted every user whose account or agent was confirmed to have been accessed. "If you haven't heard from us, no action is needed," NEAR AI stated in its latest public update. Affected customers received instructions from [email protected], and the owners of the 18 compromised agents got individual notifications. The company also advised users to treat unsolicited messages referencing their account information or balances with caution, and said regulatory notifications would follow where required.

Crypto.news reached out to NEAR AI for comment but received no response by publication time.

Why does confidential computing matter here?

The incident exposed a structural limitation in NEAR AI's confidential computing setup. The company uses TEEs to isolate sensitive information during AI processing — under normal conditions, the technology prevents infrastructure operators and underlying hosts from seeing protected data.

But confidential computing protects against access from outside the protected environment. It cannot prevent vulnerabilities in the applications running inside it. The SGLang flaw let the attacker execute code within an inference server, potentially exposing requests at the moment the software processed them.

NEAR AI has reported the vulnerability to the SGLang project's maintainers, and said its security reviews will now extend to inference software, related services, dependencies, and deployment configurations.

The stakes are commercial as well as technical. NEAR AI's confidential computing operations have kept expanding through AI inference products and blockchain-based payment services. In October, the platform surpassed one million NEAR staked through a service that lets users fund AI inference with staking rewards. Its documentation markets confidential computing as a feature of supported hosted models — a claim the incident now tests.

NEAR co-founder Illia Polosukhin had flagged the risk category in October, citing software weaknesses across internet infrastructure and calling for stronger AI-assisted security systems.

Is there any link to the Binance hack laundering?

No connection has been established. The incident occurred the same week investigators traced NEAR-based tokens moving funds tied to the Binance exchange hack. According to a November 9 Elliptic investigation, attackers created six temporary memecoins and used decentralized liquidity pools to transfer approximately $430,000 in stolen cryptocurrency. Elliptic identified roughly 117,000 NEAR routed through pools involving tokens created between November 5 and November 7.

Elliptic attributed the laundering to operators associated with the Binance theft. Neither its findings nor NEAR AI's incident report connected the two events.

With credentials replaced, the forensic review closed, and the SGLang flaw reported upstream, NEAR AI's next test is whether its broadened security reviews — now covering inference software and deployment configurations — land before another vulnerability does.