NEAR AI has reported a data breach affecting around 100 users due to a cyberattack exploiting a vulnerability in SGLang software.
NEAR AI has disclosed a data breach impacting approximately 100 users following a cyberattack on its AI server. The breach occurred on November 8, when an attacker exploited a vulnerability in the SGLang software, allowing unauthorized access to parts of NEAR AI's infrastructure.
Update: On November 8, an attacker used a vulnerability in SGLang, the inference engine we run, to access part of our infrastructure. We’ve closed the access and fixed it. Affected users have been contacted. If you haven’t heard from us, no action is needed. — NEAR AI (@near_ai) November 10, 2026
The hacker was able to execute arbitrary commands on a server handling AI requests, which led to access to other internal systems. Data compromised included user names, email addresses, and in some cases, details about subscription plans and account balances. However, NEAR AI confirmed that there were no signs of access to saved chats or uploaded files within the Private Chat service, which has since been deprecated.
The affected AI agents were operating on an outdated version and did not utilize a trusted execution environment (TEE), resulting in the exposure of their communication histories, settings, and operational logs. Additionally, API keys for two NEAR AI Cloud clients were also compromised, but have since been revoked.
Potential Exposure of Confidential Requests
NEAR AI reported that during the attack, the hacker could have viewed the contents of requests processed by the compromised server, including those marked as confidential. The company did not specify the volume of requests or whether actual data access occurred.
NEAR AI Cloud employs TEE technology, which isolates data at the hardware level, preventing server operators and cloud infrastructure providers from accessing it. However, it does not protect against flaws in software running within this isolated environment, which was the case with SGLang.
In response, NEAR AI is now rigorously reviewing the software and services surrounding request processing, similar to how they secure the trusted environment.
The development team has reported the issue to SGLang's team, but has not disclosed the CVE identifier, technical attack details, or affected software versions.
NEAR AI Cloud Service Restored
Following the breach, NEAR AI temporarily halted request processing in the cloud, revoking active sessions and admin credentials, replacing access keys for AI agents, disabling Private Chat, and patching the vulnerability across all servers. The cloud service has since resumed operations.
Affected users were notified via email, and those with compromised agents received specific instructions. The company emphasized that other clients need not take any action but advised caution regarding suspicious messages mentioning accounts or balances.
NEAR AI has committed to informing regulatory authorities about the incident. Fortunately, there are no reports of cryptocurrency theft related to this attack, and the NEAR Protocol blockchain and other ecosystem services remain unaffected.
This incident follows a similar breach on November 2, when hackers targeted the GitBook platform using AI agents.
