NEAR AI Says Attackers Downloaded Data Tied to About 100 Accounts

NEAR AI said attackers exploited a flaw in its SGLang inference server and downloaded data tied to about 100 accounts, while also accessing 18 agents on older deployments.

The company said the remote code execution vulnerability in the open-source SGLang inference engine let attackers run code on one server and enter related infrastructure. The downloaded account information included email addresses and names, as well as subscription and balance details for some users.

The 18 affected NEAR AI Agents were on older deployments outside a trusted execution environment (TEE). Attackers took chats, settings and logs from those agents, the company said.

API keys for two NEAR AI Cloud customers appeared in logs and were revoked. NEAR AI said attackers may have observed requests being processed on affected servers on Nov. 8, including requests in confidential mode. It had not found evidence that stored Private Chat conversations or uploaded files were accessed.

NEAR AI said it contained the unauthorized access, fixed the vulnerability, rotated affected credentials and restored Cloud service. It took Private Chat offline and notified affected users and owners of the 18 agents. The company reported the flaw to the SGLang project and plans to make regulatory notifications as required.