NEAR AI Breach Shows a Secure Enclave Is Only as Safe as the Inference Engine Running Inside It
NEAR AI disclosed that an attacker exploited a remote-code-execution vulnerability in SGLang, the open-source inference engine, to run code on one inference server, then downloaded account details for about 100 users of its deprecated Private Chat and data from 18 legacy agents. Requests processed on that server on November 8, including confidential-mode requests inside a trusted execution environment, could have been observed. NEAR AI has patched the flaw and rotated credentials; no CVE or fixed SGLang version has been disclosed.
NEAR AI sells private inference on the promise that requests run inside hardware enclaves the operator itself cannot see into. Its breach disclosure shows where that promise stops: an enclave protects data from the host, not from a bug in the software running inside it.
What happened#
An unauthorised party exploited a remote-code-execution vulnerability in SGLang, the open-source inference engine running on NEAR AI's servers, gaining code execution on one inference server and, from there, access to its infrastructure, the company said in an incident report dated November 9. On November 8, the attacker could also have observed user requests being processed on that server, including requests running in confidential mode.
From there, NEAR AI says, the attacker reached an internal system behind its already deprecated Private Chat and downloaded account details, including email addresses, names and for some accounts plan and balance information, for about 100 users. The attacker also accessed 18 agents on a legacy deployment of NEAR AI Agents that was not running in its confidential-computing environment, taking chat history, settings and logs. Two cloud customers' API keys were exposed in logs and have been revoked. NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed.
The enclave lesson#
NEAR AI's own explanation is the useful part for anyone buying confidential inference: confidential computing "does not protect against a vulnerability in the software running inside the environment." The company says it now treats the inference software and surrounding services with the same rigour as the enclave itself. SGLang is widely used; Times of AI has previously reported a separate SGLang bug behind Cloudflare's GLM-5.3 cross-customer data exposure.
The Hacker News, which reported the incident on November 10, noted that NEAR AI has not identified the flaw by CVE, named affected SGLang versions, or said whether the SGLang project has released a fix. It also pointed to an October write-up by Brave saying its Leo assistant runs some chats inside a NEAR AI-operated enclave; NEAR AI has not said whether the affected server handled any of those chats.
What NEAR AI did#
The company says it revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, deployed a fix across all inference servers, rotated remaining credentials and completed a forensic review. It reported the vulnerability to the SGLang project and has contacted users whose data it confirmed was accessed.
Limits#
- The account of the breach is NEAR AI's own; we have not seen an independent forensic report.
- It is not clear whether people whose requests passed through the affected server on November 8 were notified, as The Hacker News noted.
- NEAR AI disclosed the incident on November 9; we include it because independent reporting and the SGLang angle surfaced on November 10.