NEAR AI breach: a flaw in its inference software exposed user details and agent chats

NEAR AI, a company that runs open AI models for developers and businesses, says an attacker broke into part of its infrastructure through a flaw in SGLang, the open-source software it uses to run models on its servers. In a security incident report, NEAR AI says the attacker downloaded account details for about 100 users and data from 18 AI agents, and could have seen requests passing through one server on November 8, including requests sent in its “confidential” mode.

NEAR AI says the access is closed, the flaw is fixed on all its servers and its NEAR AI Cloud service is back online.

What happened

According to NEAR AI, the attacker exploited a remote code execution flaw in SGLang to run code on one inference server, the kind of machine that takes a prompt and returns a model’s answer. From there they moved further into NEAR AI’s systems:

• They reached an internal system behind Private Chat, a product NEAR AI had already retired, and downloaded email addresses and names for about 100 users, plus plan and balance information for some accounts. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.
• They reached 18 agents on an older deployment of NEAR AI Agents that wasn’t running in NEAR AI’s protected environment, and took chat history, settings and logs from them.
• Two NEAR AI Cloud customers had API keys exposed in logs. NEAR AI says it revoked both.

NEAR AI hasn’t said when the attacker first got in, beyond the November 8 window for observing requests. It also hasn’t named the SGLang versions affected, given the flaw a CVE number, or said whether the SGLang project has released a public fix. It says it reported the flaw to the project.

Why “confidential” mode didn’t stop it

NEAR AI sells private inference: requests run inside a trusted execution environment (TEE), a hardware-protected area meant to keep data hidden even from the company running the server. NEAR AI is candid that this protection has a limit. In its words, confidential computing protects data from the operator and the host, but “does not protect against a vulnerability in the software running inside the environment.” SGLang runs inside the TEE, so a bug in SGLang let the attacker see requests being processed there.

That matters beyond NEAR AI’s own customers. In an October 15 post, the browser maker Brave said its Leo assistant runs some chats inside a TEE operated by NEAR AI. NEAR AI’s report doesn’t say whether the affected server handled any Brave Leo chats, and we didn’t find a statement from Brave about the incident.

What NEAR AI did

On detection, NEAR AI says it revoked all active sessions and administrator credentials, replaced every agent token, took Private Chat offline, fixed the SGLang flaw on all inference servers, rotated its remaining credentials and completed a forensic review. It has contacted the people whose account details or agents it confirmed were accessed, by email from security@near.ai, and says it will make any regulatory notifications required. The Hacker News reports that NEAR AI later said users who haven’t heard from it don’t need to do anything.

What you can do

1. If you got an email from security@near.ai, follow the steps in it. Check the sender carefully, and sign in by typing the address yourself rather than using a link.
2. Be careful with unexpected messages about your NEAR AI account or balance, as NEAR AI advises. Account names, emails and balances are exactly what a convincing phishing email would quote.
3. If you used NEAR AI Agents, think about what you shared with your agent. If chats included passwords, keys or private details, change those passwords and rotate the keys.
4. Treat “private AI” as reducing risk, not removing it. Avoid pasting passwords, ID numbers or other sensitive details into any AI chat.

How Frame helps

If this breach is added to a breach catalog, add it to a verified email in Frame and Frame shows what it exposed and gives you a short checklist. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame never collects or stores the leaked records themselves.

Related coverage

• Railway’s final report: stolen AI keys ran up about $740,000 in charges: another AI infrastructure break-in, explained in detail this week.
• Fireworks AI says a second intrusion reached billing details, datasets and partial models: another company that runs AI models for customers, breached in October.

Sources

• NEAR AI, NEAR AI Security Incident Report: SGLang Vulnerability, November 2026
• The Hacker News, SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users, November 11, 2026
• Brave, Another Brave User-First AI Win: Leo adds End-to-end Encryption, Oblivious HTTP, and Verifiable Confidential Computing, October 15, 2026