NEAR AI confirms incident and containment

NEAR AI says an attacker exploited a remote code execution issue in SGLang on an inference server and moved to other infrastructure. The report does not identify the exploited SGLang function or CVE. An inference server is not merely a model endpoint; its execution identity and access to services can become a lateral-movement bridge when code runs inside the serving process.

NEAR AI confirmed account details for about 100 users downloaded from an older Private Chat administration system, access to 18 agents on a legacy non-TEE deployment, and exposure of two customers' cloud API keys in logs. It says historical Private Chat conversations and uploaded files were not found accessed. Requests in flight while the serving instance was compromised could potentially have been observed; the report does not count or demonstrate such captured requests.

Production incident beginning November 8, described November 9. The legacy agents were outside the confidential-computing environment; the initial inference server and downstream internal systems had distinct boundaries.

No attacker attribution, RCE primitive, exploitable version, per-message theft count or confirmed access to all confidential-mode users is established. A TEE promise cannot be treated as protection against malicious code executing within its permitted workload.

NEAR AI's November 9 incident notice supplies an unusually important enclave boundary. Exploitation of a remote-code-execution flaw in SGLang gave the intruder control inside one inference server. On November 8 the intruder therefore could have observed requests in progress, including confidential-mode requests, although NEAR did not report a verified number of intercepted requests. A trusted execution environment can isolate a workload from its operator while still failing to defend against malicious behavior executing inside that workload.

The downstream findings are separately measurable: approximately 100 users' account details behind a deprecated Private Chat service, 18 legacy Agents whose data included histories/settings/logs, and API keys for two cloud customers visible in logs. NEAR says those 18 agents were not protected by its confidential-computing configuration and that it found no access to stored Private Chat conversations or uploaded files. It revoked sessions and keys, rotated agent tokens and patched deployed inference servers. This account does not identify the exact SGLang version or give a public working exploit.