NEAR AI discloses breach exposing data from about 100 users and 18 agents

An attacker gained the ability to run code inside a NEAR AI server, then reached user records and older AI agents. In its November 9 security incident report, the company confirmed data theft affecting about 100 users and 18 agents—and warned that requests in confidential mode could also have been visible on the compromised server.

The vulnerable software was inside the protected environment

The entry point was SGLang, the open-source inference engine NEAR AI uses to process AI requests. A remote-code-execution vulnerability let the attacker run their own code on one inference server. From that foothold, they gained access to other parts of the company’s infrastructure.

Confidential mode processes requests inside a trusted execution environment, or TEE, designed to keep data private even from the service operator. But SGLang ran inside that environment. NEAR AI says confidential computing protects data from the operator and host, not from vulnerabilities in the software processing the data within it.

That distinction put requests being processed on the accessed server within possible reach. NEAR AI says the attacker could have observed those requests on November 8, 2026, including confidential ones. This is possible exposure during processing, not a confirmed finding that the attacker copied those requests. The company separately identified records and agent data that were actually downloaded.

It does not protect against a vulnerability in the software running inside the environment, and that is what happened here

NEAR AI, November 9 security incident report

Two older services held the confirmed stolen data

After reaching the infrastructure, the attacker accessed an internal system behind Private Chat, a product NEAR AI had already deprecated. They also reached a legacy deployment of NEAR AI Agents. Those 18 agents were not running in the company’s confidential computing environment, separating that confirmed theft from the possible exposure of confidential requests.

• Private Chat account records: Names and email addresses for approximately 100 users were downloaded. For some accounts, the records also included plan and balance information.
• Legacy agent data: The retrieved material included chat history, settings and logs from the 18 affected agents.
• Cloud credentials: Logs exposed NEAR AI Cloud API keys belonging to two customers. The company revoked both keys.

NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed. That finding applies to Private Chat’s stored content; it does not describe the agent chat histories, which the company confirmed were retrieved.

NEAR AI’s fix is not an upstream patch confirmation

On detecting the intrusion, NEAR AI revoked all active sessions and administrative credentials, replaced all agent tokens and took Private Chat offline. It says it deployed a fix across every inference server, finished rotating the remaining credentials and completed a full forensic review. Access to NEAR AI Cloud has been restored.

The company reported the vulnerability to the SGLang project. However, The Hacker News noted on November 10 that NEAR AI had not supplied a CVE tracking number, identified affected SGLang versions or said whether the project had released a fix. NEAR AI’s server remediation therefore does not identify a public patched version for other SGLang operators to install.

NEAR AI also says it is expanding security analysis to treat inference software and services around the protected enclave with the same rigor as the enclave itself. The code, dependencies and deployment configurations for its confidential inference stack remain public so people can verify what is running, according to the company.

Users whose account details or agents were confirmed accessed have been contacted directly from security@near.ai, with steps specific to them. NEAR AI cautions users to treat unsolicited messages referring to their account or balance carefully. It says it will make any required regulatory notifications.