An attacker used a remote code execution vulnerability in SGLang, an open-source inference engine, to run code on one of NEAR AI's inference servers last Sunday. The company said this week that the intruder could also have seen requests processed on that server that day, including requests sent in confidential mode - a mode that handles requests inside a trusted execution environment (TEE) meant to keep them private even from NEAR AI itself.

The TEE, however, "does not protect against a vulnerability in the software running inside the environment," the company said. SGLang runs inside the TEE, which is how the attacker could reach those requests.

That access has since been closed, but not before the attacker moved deeper into company systems. The intruder reached an internal system behind Private Chat, a product NEAR AI had already deprecated, and the company has confirmed the download of account details for about 100 users - email addresses and names, plus plan and balance information for some accounts. NEAR AI found no sign that stored Private Chat conversations or uploaded files were accessed.

The attacker also reached 18 AI agents on an older deployment of NEAR AI Agents that did not run inside the TEE, taking data including chat history, settings and logs. Two customers' NEAR AI Cloud API keys were exposed in logs; both have been revoked.

After detecting the attack, NEAR AI revoked all active sessions and administrator credentials, replaced all agent tokens, took Private Chat offline, deployed a fix for the SGLang flaw across its inference servers, rotated remaining credentials and completed a full forensic review, according to its incident report. NEAR AI Cloud access has been restored.

The company reported the flaw to the SGLang project but has not identified it by CVE number, named affected SGLang versions, or said whether a fix has been released. It has contacted users whose account details or agents were confirmed accessed, with messages from security@near.ai; users who have not heard from the company need do nothing, it said in a follow-up post. It has not said whether people whose requests passed through the affected server last Sunday were among those contacted.

In an October 15 technical write-up, browser maker Brave said its Leo assistant runs chats with the GLM 5.3 Flash model inside a TEE operated by NEAR AI. NEAR AI has not said whether the affected server handled any of those chats.

Source: The Hackers News