• NEAR AI restored Cloud after an attacker exploited SGLang on November 8

• The breach exposed email addresses and names of approximately 100 users

• Chat histories, settings and logs from 18 legacy AI agents were accessed

Inside the SGLang Post-Mortem

NEAR AI's Cloud inference service is back online, and the security report the team published on November 9 sets out how much an attacker saw before access was cut. The breach began on November 8, when the attacker exploited a remote code execution flaw in SGLang, the open-source inference engine running on NEAR AI's servers, executing code on a single inference server and then reaching into other parts of the infrastructure. From that foothold, the intruder connected to an internal system tied to the previously discontinued Private Chat service and downloaded account information for approximately 100 users. The records carried email addresses and names, and for some accounts subscription plan and balance details, the kind of identity data platforms normally collect through KYC verification. The report found no evidence that stored Private Chat conversations or uploaded files were accessed. Investigators did confirm unauthorized access to 18 agents running on an older version of NEAR AI Agents, deployments that sat outside the company's trusted execution environment, or TEE, the hardware-based isolation layer for confidential computing. Chat histories, configuration settings and operational logs were pulled from those agents, and two Cloud customers had API keys exposed through the logs; both credentials were subsequently revoked. The team further established that the attacker could have observed requests processed on the compromised inference server on November 8, including requests running in confidential mode, although the report does not say how many. The NEAR Protocol blockchain and other ecosystem services were unaffected, and the NEAR price, which our live monitoring shows moved 4.4% over the past 24 hours, traded through the incident without a protocol-level cause.

Response work started as soon as the unauthorized access was detected. NEAR AI suspended Cloud inference after detecting the entry point and kept the service paused while engineers finished the security work. A follow-up update on X confirmed that Cloud infrastructure returned online after fixes were deployed across servers and affected credentials were replaced. The remediation list was specific: active sessions and administrative credentials revoked, agent tokens replaced, Private Chat taken offline, and the SGLang fix applied across all inference servers before the remaining rotations wrapped up. An earlier public post distilled the timeline, noting that affected users have been contacted and adding: “If you haven’t heard from us, no action is needed.” A full forensic review is complete, owners of the 18 compromised agents received individual notifications, and regulatory notifications will follow where required. The report's account of the root cause is the sharpest part of the document. NEAR AI runs trusted execution environments to isolate sensitive data during AI processing, but the flaw let the attacker execute code inside an inference server, potentially exposing requests as the software handled them. Confidential computing, the report explains, blocks access from outside the protected environment and cannot stop vulnerabilities inside the applications running within it. The issue has been reported to the SGLang maintainers, and future security reviews will cover inference software, related services, dependencies and deployment configurations, a scope that mirrors structured blockchain security audits. Context rounds out the picture. In October the platform surpassed one million NEAR staked through a service that funds AI inference with staking rewards, putting part of the token's circulating supply to work, and co-founder Illia Polosukhin warned that same month about weaknesses across internet infrastructure. Separately, a November 9 Elliptic investigation found roughly $430,000 stolen in the Binance exchange hack moved through six temporary memecoins and decentralized liquidity pools, with about 117,000 NEAR routed via pools built from tokens created between November 5 and November 7; our earlier report on the Binance hack memecoin laundering covered those flows, and neither that probe nor NEAR AI's report connects the two security events.

Read against the post-mortem, the blast radius was metadata rather than money. The report's own accounting shows sessions revoked, credentials rotated and the vulnerable engine patched, and nothing in it suggests a private key or any custodial holding left the platform's control; assets in a user's own crypto wallet sit at the protocol layer, which the company says was untouched. The transferable lesson is the one NEAR AI wrote down itself: a trusted execution environment cannot compensate for a bug in the application running inside it, which is why the review scope now extends to inference software and dependencies. The roughly 100 users with exposed emails and names are likelier phishing targets, so the red flags of crypto scams that reference balances or account details deserve real caution. As of the November 10 updates, Private Chat remained offline and the credential rotations were complete.