What happened
An unspecified remote-code-execution vulnerability in SGLang gave the attacker code execution on one inference server. NEAR AI said that on November 8, 2026, the attacker could have observed requests processed on the accessed server, including confidential-mode requests. On November 9, 2026, NEAR AI published its incident report, said access had been closed, and reported that NEAR AI Cloud had been restored.
NEAR AI reported downloaded account details for approximately 100 users, access to chat history, settings and logs from 18 legacy agents, and two customer API keys exposed in logs. NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed. The company said it revoked sessions and administrative credentials, replaced agent tokens, rotated remaining credentials, took Private Chat offline and deployed a fix across its inference servers.
The cited sources identify SGLang as the open-source inference engine and NEAR AI Agents as the affected legacy agent platform. No underlying model name or version was identified in the cited sources. NEAR AI operated SGLang on its inference servers, while the 18 affected legacy agents were outside its confidential-computing environment. SGLang mechanically processed inference requests; exploitation of the engine’s remote-code-execution flaw allowed code execution on one server and access to requests in processing. Attribution posture: NEAR AI named no actor and did not establish the attacker’s identity or motive. The cited source did not publish the relevant detection detail described as Public vulnerability and compromise artefacts.
Why this matters now
The incident exposes a critical assurance boundary in confidential AI services. Trusted execution environments can protect data from the host and operator, but they do not protect plaintext while vulnerable inference software processes it. Security reviews that stop at attestation, encryption or enclave claims can therefore miss the component that directly handles prompts, agent state and credentials.
The enterprise decision extends beyond NEAR AI customers. SGLang is an open-source inference engine, yet the cited sources provide no CVE, affected-version range or public upstream fix. Organisations using hosted or self-managed inference need a decision-grade inventory of engines, exposure paths, logs and adjacent systems. Without that inventory, they cannot determine whether a provider-side private fix also resolves their own deployments.
The decision for security leaders
Require AI-service assurance to describe both enclave protections and the software running inside the protected environment. The provider must identify the inference engine, patch ownership, deployment version, network boundaries, logging and the systems reachable from an inference host. Attestation without component-level vulnerability management is incomplete assurance.
For internal deployments, treat SGLang as an application dependency requiring inventory and exposure control while upstream details remain unavailable. For hosted services, obtain written confirmation of the deployed fix and affected-data assessment. Privacy and data owners should separately determine which prompts, agent histories or secrets may have traversed the affected service.
Evidence of closure
- Deployment inventory identifies every SGLang instance, owner and exposure path.
- Provider assurance names the fixed version or explicitly documents the current limitation.
- Log review shows no unexpected child processes or internal-system access.
- Credential register confirms exposed keys and tokens were revoked and replaced.
The Security.io assessment
The company disclosure establishes exploitation, data access and a concrete limitation of confidential computing, but it leaves important operational gaps. The number of requests potentially observed, the intrusion duration, the vulnerable SGLang component and the upstream remediation status are not published. That limits customers’ ability to translate the provider’s private fix into an enterprise-wide exposure decision.
No CVE identifier, affected SGLang version, public fixed version, malicious IP address, domain or file hash was published in the cited sources. The absence of these artefacts does not negate the incident, but it prevents precise external hunting. Medium confidence reflects strong primary confirmation of impact combined with limited independently testable technical detail.
Questions for the morning meeting
- Does confidential-computing assurance cover software running inside the enclave?
- Who owns patching the inference engine beneath hosted AI services?
- Can the organisation locate secrets written into agent and inference logs?