NEAR AI breach: unpatched SGLang bug exposed agents and keys

An AI cloud got breached through the software that runs the models. NEAR AI published a security incident report on November 9. It says an attacker exploited an unpatched SGLang vulnerability on November 8, got code execution on one inference server, and moved from there into wider infrastructure. The NEAR AI breach is a clean lesson for anyone running or buying AI inference: the model is not the attack surface. The server around it is.

What actually happened

Everything below comes from NEAR AI's own report.

• The way in. A remote code execution bug in SGLang, the open-source inference engine. NEAR AI hadn't patched it.
• Account data. The attacker reached an internal system behind NEAR AI's deprecated Private Chat product and downloaded details for about 100 users: email and name, plus plan and balance for some.
• Agents. The attacker accessed 18 agents on a legacy deployment of NEAR AI Agents that ran outside the trusted execution environment (TEE). Chat history, settings and logs were taken.
• Live traffic. On November 8, the attacker "could also have observed user requests being processed on the accessed server, including requests running in confidential mode."
• Keys. Two NEAR AI Cloud customers had API keys exposed in logs. Those keys are revoked.
• What wasn't touched. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.
• The response. Private Chat went offline. NEAR AI patched SGLang everywhere, rotated credentials and tokens, and reported the bug upstream. Cloud access is restored.

One line in the report deserves a highlight: confidential computing "does not protect against a vulnerability in the software running inside the environment."

Why it matters for your business

Two failures stacked here, and both are common.

Unpatched inference software. SGLang, vLLM and Ollama now sit where web servers sat ten years ago: internet-facing, under heavy development, and patched far less often. We've written about SGLang RCE bugs before. If you self-host a model, the engine needs the same patch schedule as your OS.

Secrets in logs. API keys ended up in logs, and logs got read. That's not an AI problem. It's the oldest problem in ops.

What we'd do this week:

1. List your inference software and its versions. Pin them, and subscribe to their security advisories.
2. Keep inference servers off the public internet. Put them behind a gateway that handles auth.
3. Grep your logs for keys. Mask Authorization headers and sk- style strings at the logger, not after the fact.
4. Ask your AI vendor two questions. How fast do you patch your serving stack? Are customer keys or prompts ever written to logs?

Sources: NEAR AI security incident report.