NEAR AI Breach Reveals User Details and Data From 18 Legacy Agents

Table of Contents

• You might want to know


• Main Topic


• Key Insights Table


• Afterwards...

You might want to know

• What information did the attacker obtain from NEAR AI, and which users or services may have been affected?


• How could a software vulnerability undermine privacy protections designed to isolate AI workloads?

Main Topic

NEAR AI disclosed that an attacker exploited a vulnerability in SGLang, software used to run AI models and generate responses to user requests. According to the company’s report dated November 9, the intrusion began on an inference server and ultimately gave the attacker a way to reach other parts of NEAR AI’s internal infrastructure. The incident exposed account information associated with approximately 100 users and data from 18 agents on an older deployment.

SGLang is an open-source engine used to serve AI models. NEAR AI said the attacker used a remote code execution vulnerability, a type of flaw that can allow an intruder to run commands on a vulnerable system. In this case, the commands were executed on an inference server. Investigators later traced the intrusion to an internal system connected to Private Chat, a feature that NEAR AI had already retired.

The account information downloaded by the attacker included names and email addresses for approximately 100 users. For some of those accounts, the material also included subscription plan and account balance information. The company has not said that every affected user had all of these details exposed; its report describes the additional subscription and balance information as applying to some users.

Separately, the attacker accessed 18 agents running on an older deployment of NEAR AI Agents. Information retrieved from these agents included chat histories, settings, and logs. NEAR AI said these agents were not running within its confidential computing environment, which is intended to protect information from the organization operating the servers.

The incident also exposed NEAR AI Cloud API keys belonging to two customers. API keys act as digital credentials, allowing applications to authenticate to and use cloud services. NEAR AI said it revoked both keys, but did not state whether the attacker had used them. Customers should therefore distinguish between the confirmed exposure of the credentials and any unreported use of those credentials.

The confirmed data theft involved user account records and information from legacy agents; the company did not find evidence that stored Private Chat conversations or uploaded files were accessed. At the same time, NEAR AI said its investigation could not rule out the possibility that requests being processed in confidential mode on November 8 may have been visible. That possibility is not the same as confirmation that stored conversations or files were taken.

NEAR AI’s Cloud product uses trusted execution environments, commonly known as TEEs. These environments are designed to encrypt and isolate AI prompts so that server operators cannot readily inspect them while models process them. The approach provides a layer of hardware-based isolation, but it does not make the software running within the protected environment immune to flaws.

NEAR AI acknowledged this limitation in its explanation of the breach: a TEE does not protect against a vulnerability in software running inside the environment. The SGLang flaw reportedly allowed the attacker to execute code in a location where confidential requests were being processed. This highlights an important distinction: hardware security can help isolate a workload, while the security of the applications and services inside that boundary remains essential.

The incident is notable because privacy is a central part of NEAR AI’s product positioning. NEAR AI is part of the wider NEAR ecosystem, which has promoted AI privacy alongside its blockchain work. In October, the company announced that Brave’s Leo browser assistant was using its confidential inference infrastructure for a supported AI model. The incident report did not identify Brave users among those affected, and it does not establish that the October announcement or that service was connected to the breach.

SGLang had previously drawn attention from security researchers. In July, Carnegie Mellon University’s CERT Coordination Center documented six vulnerabilities in the project. Depending on server configuration, the reported issues included vulnerabilities that could allow command execution or credential exposure. However, NEAR AI did not identify the specific SGLang flaw used in this incident. As a result, the breach cannot be directly linked to any of the vulnerabilities described in that earlier work. NEAR AI said it reported the vulnerability to SGLang’s developers.

After detecting the intrusion, NEAR AI said it revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers. The company later reported that it had completed the rotation of remaining credentials and a full forensic review. These actions were intended to limit continued access, invalidate credentials that could have been compromised, and address the vulnerable software.

NEAR AI said it notified users whose account information or agents it had confirmed were accessed. It also contacted the owners of all 18 affected agents individually and said it would make any regulatory notifications that are required. The company advised users to be cautious about unsolicited messages referring to their NEAR AI accounts or balances. Such messages could attempt to exploit the incident by impersonating the company or using information about an account to appear credible.

The available disclosure leaves some questions unanswered. NEAR AI did not identify the precise SGLang vulnerability, explain whether the two exposed API keys were used, or confirm whether any confidential-mode requests were actually viewed. These points should be treated as unresolved rather than assumed to have occurred. The company’s public account distinguishes confirmed exposure from risks that remain possible based on the investigation.

For affected users and customers, the practical response is to pay attention to direct notices from NEAR AI, remain alert for suspicious communications, and follow any recommended account-security steps. Customers that used the exposed API keys should rely on the company’s revocation and credential-rotation measures while checking their own service records for unexpected activity. More broadly, the event demonstrates why organizations operating AI services need to secure the entire stack—from hardware isolation and model-serving software to credentials, internal systems, and incident response.

Key Insights Table

Afterwards...

The NEAR AI incident illustrates that protecting AI systems requires more than encrypting prompts or placing workloads inside hardware-isolated environments. Those mechanisms can reduce exposure to infrastructure operators, but they cannot by themselves prevent exploitation of vulnerable software, misuse of credentials, or movement between connected internal systems.

Organizations building confidential AI services should continue exploring secure software development, stronger isolation between services, careful credential management, and independent security testing of model-serving components. Research into memory-safe systems, vulnerability discovery, and verifiable software builds may also help reduce the likelihood that a flaw in one component can compromise a broader environment.

Transparency is another area for continued improvement. Clear incident reports can help users understand which data was confirmed exposed, which risks remain under investigation, and what actions are being taken. As AI services become more integrated into browsers, cloud platforms, and everyday applications, durable privacy will depend on combining hardware protections with secure software, rapid response, and precise communication.