The report
NEAR AI reported on November 9 that a remote-code-execution vulnerability in SGLang let an intruder run code on one inference server and subsequently reach internal systems. It identified three confirmed downstream data categories and one exposure that remains possible rather than quantified.
What was reached
NEAR says approximately 100 users had account details downloaded from an internal system behind a deprecated Private Chat service. Eighteen agents on a separate legacy deployment were also accessed; these were not operating in its confidential-computing environment, and their retrieved data included chat histories, settings and logs. API keys belonging to two NEAR AI Cloud customers appeared in logs and were revoked. NEAR reports no evidence that stored Private Chat conversations or uploaded files were accessed.
The inference server was accessed on November 8. Requests it was processing at the time, including requests in confidential mode, could have been observed. NEAR does not give a measured count of captured confidential requests. Those limits matter more than a blanket claim that all private inference was breached. The incident Case and NEAR’s own report preserve the distinction.
Where the enclave stops helping
A trusted execution environment can isolate a workload from the host operator. It cannot make code running inside the permitted workload immune to its own software vulnerabilities. SGLang was running within the serving process whose authority became useful to the attacker. Downstream access to old application services represented another authorization boundary, not proof of breaking the hardware enclave itself.
NEAR says it patched its SGLang servers, replaced credentials and sessions, revoked agent tokens, and notified affected users. It has not publicly supplied the exact vulnerable function or version range. Operators evaluating confidential inference should therefore ask two distinct questions: what protects the inference process from host inspection, and what that process can reach after it has been compromised.