SGLang Consortium: Nvidia, Google, Meta back open inference

LMSYS Org, the nonprofit behind the SGLang inference engine, launched the SGLang Consortium on Thursday with NVIDIA, AMD, Intel, Google, Meta, Cloudflare, Modal and RadixArk as founding members. If you self-host open-weight models, there's a good chance SGLang or something like it sits under your stack. More corporate backing is good news for that stack. It is not a security plan, and the announcement doesn't include one.

What actually happened

Per the Business Wire release, the consortium was announced in the opening keynote of the first SGLang Summit in San Francisco (November 12–13). It is a standing forum: each founding member names a technical representative, members join two roadmap meetings a year, and they contribute engineering, deployment feedback, testing resources or joint development. The focus areas are frontier model support, reasoning and multimodal workloads, distributed inference and hardware optimization.

SGLang's maintainers keep control of technical decisions and which code is accepted, and the release says the project stays open to the whole community. LMSYS says SGLang runs on hundreds of thousands of GPUs and powers large production deployments at Meta, Microsoft, Google, Amazon, Cloudflare and others.

What the release does not say: no license change, no membership fees or funding amounts, no benchmarks, and no security or vulnerability-disclosure process.

Why open-source inference backing matters for your business

Eight hardware and cloud vendors working on one engine means better support for new models and new chips, sooner. If you run inference on your own GPUs, that's real value.

But we've written about SGLang twice this year for the wrong reasons: an unauthenticated RCE and a breach tied to an unpatched SGLang server. A roadmap forum doesn't change who applies the patch. You do.

If you self-host:

1. Pin the version and track SGLang releases and GitHub advisories.
2. Never expose the server to the internet. Put it behind your own authenticated gateway.
3. Keep API keys out of logs and rotate them on a schedule.
4. Keep a fallback route to a hosted API, so a patch window isn't an outage.

Sources: Business Wire, Yahoo Finance (release copy).