Vulnerabilities · AI Security
NEAR AI breach exposes user and agent data after server exploit
An attacker exploited a flaw in NEAR AI's SGLang server, accessing data from about 100 users and 18 AI agents. The company has fixed the issue and notified affected users.
Ross Grant3 min read
The short version
An attacker broke into NEAR AI by exploiting a flaw in its SGLang server software. They accessed data from about 100 users and 18 AI agents, including names, emails, and chat logs. NEAR AI has fixed the problem and contacted those affected. The company says most users do not need to do anything.
By the numbers
- 100users' account details accessedThe Hacker News
- 18AI agents' data accessedThe Hacker News
What happened?
An attacker exploited a remote code execution flaw in NEAR AI's SGLang inference engine, running code on an inference server. The attacker accessed data from about 100 users and 18 AI agents, including account details and chat histories. NEAR AI has fixed the flaw on its servers and notified affected users. Only The Hacker News has reported this so far.
What was taken
According to The Hacker News (opens in a new tab), the attacker downloaded account details for about 100 users of NEAR AI's deprecated Private Chat product. The stolen data included email addresses, names, and for some users, plan and balance information. The company found no evidence that chat conversations or uploaded files were accessed in this part of the breach.
The attacker also accessed 18 AI agents on an older version of NEAR AI Agents. From these agents, the attacker took chat history, settings, and logs. In addition, two customers' NEAR AI Cloud API keys were exposed in logs, which the company has since revoked.
How the attack worked
The breach began when an attacker exploited a remote code execution (RCE) flaw in SGLang, an open-source inference engine. This allowed the attacker to run code on one of NEAR AI's inference servers. On the day of the attack, the attacker could view requests being processed on that server, including those sent in "confidential mode." Confidential mode is designed to keep requests private by processing them inside a trusted execution environment (TEE), but the company explained that the TEE does not protect against vulnerabilities in the software running inside it. Since SGLang runs inside the TEE, the attacker could access data processed there.
After gaining access, the attacker moved deeper into NEAR AI's systems, reaching an internal system behind the now-retired Private Chat product and older deployments of NEAR AI Agents that did not use the TEE.
The response
NEAR AI responded by closing the attacker's access, revoking all active sessions and administrator credentials, replacing all agent tokens, and taking Private Chat offline. The company also deployed a fix for the SGLang flaw across all inference servers, rotated remaining credentials, and completed a forensic review. Access to NEAR AI Cloud has been restored. The company reported the flaw to the SGLang project but has not named the affected versions or said if a public fix is available.
Affected users were contacted directly by NEAR AI with instructions. The company advised all users to be cautious of unexpected messages about their account or balance. Users who did not receive a notification do not need to take action, according to NEAR AI.
Is there a fix?
NEAR AI has patched its own servers, but it is unclear if the SGLang project has released a public fix or which versions are affected. The company has reported the flaw to the SGLang developers.
Who is affected
The breach affected about 100 users of Private Chat and 18 AI agents running on older infrastructure. Two customers' API keys were also exposed. It is not clear if any other customers, such as those using NEAR AI's confidential mode for third-party services, were impacted. NEAR AI has not said whether the affected server handled chats for other companies, such as Brave's Leo assistant, which uses NEAR AI's TEE servers.
Claimed vs confirmed
- Confirmed
Attacker accessed requests in confidential mode processed by the TEE.
NEAR AI confirmed the attacker could see requests processed in confidential mode on the affected server.
- Confirmed
Attacker accessed chat histories, settings, and logs from 18 AI agents.
NEAR AI confirmed this in its incident report, as reported by The Hacker News.
- Denied
Attacker accessed stored conversations or uploaded files from Private Chat.
NEAR AI said it found no sign that stored conversations or uploaded files were accessed.
Why it matters
This breach shows that trusted execution environments (TEEs) cannot protect data if the software inside them is vulnerable. It also highlights the risks of using open-source AI tools and the importance of patching quickly.
Key points
- Attacker exploited a remote code execution flaw in SGLang on NEAR AI's server
- Data from about 100 users and 18 AI agents was accessed
- Trusted execution environments do not protect against software vulnerabilities
- NEAR AI has fixed the flaw and notified affected users
- It is unclear if a public fix for SGLang is available
Sources
The Hacker News
Reference
