1. Near AI breach: about 100 accounts and 18 agents affected
Near AI disclosed in a November 9 incident report that an attacker broke into its infrastructure through a remote code execution flaw in SGLang, the open-source software it uses to run AI models. The intruder downloaded account details for about 100 users, pulled data from 18 older AI agents and exposed the API keys of two cloud customers.
The company, which markets privacy-preserving artificial intelligence services, said the confirmed theft was limited to account records and data from a legacy agent deployment. It also acknowledged a more uncomfortable possibility: requests handled in its confidential mode on November 8 may have been visible to the attacker while they were being processed.
Near AI said it found no evidence that stored Private Chat conversations or files uploaded by users were accessed. The distinction between what was demonstrably taken and what could merely have been observed runs through the entire disclosure, and it shapes how customers are being asked to assess their own exposure.
2. How did the attack work?
The attacker exploited a remote code execution vulnerability in SGLang, ran commands on one of Near AI's inference servers and then moved from that machine into other parts of the company's infrastructure. Remote code execution is among the most serious classes of software flaw, because it lets an outsider run instructions of their own choosing on someone else's computer.
SGLang is an open-source engine that loads AI models and generates responses to the requests users send. Software of this kind sits directly in the path of every prompt and every answer, which makes it an attractive target. A weakness there does not merely expose a peripheral system; it gives access to the machinery that does the actual work.
Inference servers are the machines that hold a trained model in memory and compute its replies. They are typically equipped with specialized hardware and are connected, directly or indirectly, to the systems that authenticate users, record usage and store logs. Those connections are what allow a compromise of one server to become a compromise of something larger, as happened here.
From that initial foothold on a single inference server, the intruder did not stay put. Investigators followed the trail to an internal system connected to Private Chat, a feature Near AI had already retired. Old services that remain connected to live infrastructure are a familiar source of risk, since they tend to hold real data while receiving less attention than current products.
3. What data was taken
Three categories of information were affected. The first was account data: from the system tied to Private Chat, the attacker downloaded the names and email addresses of about 100 users. For some of those users, details of their subscription plan and account balance were taken as well.
The second was agent data. The attacker reached 18 agents hosted on an older deployment of Near AI Agents and retrieved their chat histories, settings and logs. These agents were not running inside the company's confidential computing environment, the protected setup intended to shield data even from the business operating the servers. They therefore lacked the layer of protection Near AI promotes for its newer services.
The third involved credentials. Logs revealed Near AI Cloud API keys belonging to two customers. API keys are the digital credentials that applications present in order to use a cloud service, and anyone holding a valid key can generally act as the customer it was issued to. Near AI revoked both keys. It did not say whether the attacker had made use of them before that happened.
Names, email addresses and balance information may appear modest next to stolen funds or passwords, but they are the raw material for targeted deception. A message that correctly cites a person's account and how much is in it is far more convincing than a generic one, which is why the company has paired its disclosure with a specific warning to users.
4. What is Near AI?
Near AI is the artificial intelligence arm of the wider Near ecosystem, which promotes private AI alongside its blockchain work. Its cloud product is built around the promise that prompts stay encrypted and isolated from the operators of the servers while they are being processed.
The technology behind that promise is the trusted execution environment, or TEE. A TEE is a hardware-enforced enclave: a sealed region of a processor in which code and data are kept apart from the rest of the machine, including from administrators with full control of the host. In principle, a provider using TEEs cannot read what its customers submit, even if it wanted to. The approach is meant to replace a promise of good behavior with a technical barrier, so that customers do not have to rely on the operator's word that their prompts are left alone.
Privacy is therefore not an optional extra for the company but the central feature it sells, which makes the incident awkward. In October, Near AI announced that Leo, the assistant built into the Brave browser, was using its confidential inference infrastructure for a supported model. The incident report does not identify any Brave users among those affected.
5. Hardware isolation does not fix vulnerable software
The breach illustrates a limit that applies to every confidential computing system. Sealing a workload off from the server operator says nothing about whether the software running inside the sealed area is itself free of defects. If that software can be manipulated, the attacker ends up inside the protected space rather than outside it.
Near AI conceded as much. The company acknowledged that the SGLang flaw allowed the attacker to run code in the place where confidential requests were processed. That is the basis for its statement that confidential-mode requests handled on November 8 may have been visible, even though no stored Private Chat conversations are known to have been reached.
The practical difference matters to users. Stored conversations and uploaded files sit at rest and, according to the company, show no sign of having been touched. Live requests are different: they pass through the inference engine at the moment they are answered, and an intruder with code running in that environment could potentially watch them go by. Near AI has presented this as a possibility surfaced by its investigation, not as confirmed theft.
6. SGLang has drawn security scrutiny before
Concerns about the inference engine predate this incident. In July, the CERT Coordination Center at Carnegie Mellon University documented six vulnerabilities in SGLang. Depending on how a server was configured, some of them could allow attackers to run commands or expose credentials.
There is no established connection between those findings and the Near AI intrusion. The company did not specify which flaw the attacker used, so nothing in its report supports linking the breach to the earlier disclosures. Near AI said it reported the vulnerability to SGLang's developers.
The episode nonetheless points to a dependency shared across the AI industry. Many providers build their services on open-source components that they did not write, and a defect in one widely used package can become a route into any business running it. For a company whose pitch rests on confidentiality, the security of those underlying components is as important as the hardware protections layered on top.
7. How Near AI responded
Near AI described a rapid containment effort. "On detection, we revoked all active sessions and administrative credentials," the company said. It also replaced agent tokens, took Private Chat offline and patched SGLang across its inference servers.
Beyond those first steps, the company said it has finished rotating its remaining credentials and has completed a forensic review. Rotating credentials means replacing keys, tokens and passwords with new ones, so that anything the attacker may have copied stops working.
The order of those actions reflects standard practice in incident response: first remove the intruder's ability to act, then close the hole that let them in, and only afterwards establish in detail what was reached. The disclosure's figures, roughly 100 accounts, 18 agents and two customers whose keys appeared in logs, describe what that work was able to confirm.
Each measure addresses a different part of the intrusion. Ending sessions and revoking administrator access cuts off anyone already inside. New agent tokens prevent stolen ones from being reused against the affected agents. Removing Private Chat closes the retired system through which account data was taken, and the patch addresses the entry point itself.
8. What happens next for affected users
Users whose accounts or agents were confirmed as accessed have been notified, and Near AI said it contacted the owners of all 18 affected agents individually. The company also said it will make any regulatory notifications that are required.
It has warned users to be cautious about unsolicited messages that refer to their Near AI accounts or balances. Because the stolen records include names, email addresses and, in some cases, balance details, anyone holding them could craft convincing messages impersonating the company.
Several questions remain open after the report. Near AI has not identified the specific SGLang flaw involved, has not said whether the two exposed API keys were used before being revoked, and has described the exposure of confidential-mode requests on November 8 only as a possibility. For customers who chose the service precisely because of its privacy guarantees, those unresolved points are likely to matter as much as the confirmed losses.