NEAR AI says an SGLang flaw exposed account data and agent logs despite confidential computing

NEAR AI said in a security incident report published on November 9 that an attacker used a remote code execution vulnerability in SGLang, the open-source inference engine running on its servers, to gain code execution on one inference server and then reach an internal system. The company says the attacker took names and email addresses for about 100 users and data from 18 legacy agents, and that it has found no sign that stored Private Chat conversations or uploaded files were accessed.

What data did the attacker reach?

According to NEAR AI's incident report, the attacker got in through the SGLang flaw and reached an internal system behind Private Chat, a feature the company had already deprecated. The Block's coverage summarises the same report. The categories NEAR AI lists are set out below.

The report says the company revoked active sessions and administrative credentials, replaced agent tokens, rotated the remaining credentials, took Private Chat offline and deployed a fix for the vulnerability across all inference servers. It says it completed a forensic review, reported the flaw to the SGLang project, and will make regulatory notifications where required. According to The Block, NEAR AI Cloud access was paused during the investigation and has been restored.

Did confidential computing protect the requests?

NEAR AI sells confidential inference, in which requests are processed in a trusted execution environment. The report states the limit plainly: confidential computing protects data from the operator and the host, but not from vulnerabilities in software running inside the environment. Because the attacker had code execution on an inference server, the report says they could have observed requests being processed on it, including confidential-mode requests, on November 8.

That distinction is the part of the report most likely to be cited later. The protection NEAR AI describes is aimed at the party running the machine; a flaw in the inference software sits on the other side of that boundary. The company says it is now applying the same security rigor to the inference software and surrounding services as to the enclave itself, and that the code, dependencies and deployment configurations of its confidential inference stack remain public.

The report does not give a CVE identifier, an intrusion date or a detection date, so those details are not established here.

How does this compare with other AI platform incidents?

NEAR AI's report is not the only recent disclosure from an AI infrastructure provider. In its October 2026 security bulletin, Fireworks AI said it identified unauthorized use of internal Fireworks credentials on October 6, and that a third party accessed environment variables used in evaluation jobs in a limited number of customer accounts. Fireworks said API keys and tokens stored as secrets were likely captured in some accounts, and that it found no evidence of unauthorized access to customer models, datasets, training data, personal information or inference traffic inside its security perimeter.

The two reports describe different causes. What they share is that the material at risk was credentials and account data held around the model, not only the prompts passing through it. The earlier OpenAI report on test models that bypassed access controls is a different kind of incident, with a model rather than an outside attacker reaching credentials, but it also turned on secrets stored where something could read them.

What does it mean for people sending data to AI services?

Neither report says anything about the legal obligations that follow. NEAR AI says only that it will make regulatory notifications where required. For readers assessing what such a notice would cover, the relevant concepts are prompt leakage, where the content of prompts reaches parties it was not meant for, and the broader category of data loss prevention. Sonomos has also covered how AI agents change the data privacy picture.

What is unresolved?

NEAR AI has not said how long the attacker had access, how many confidential-mode requests could have been observed, or whether any were. It reports no indication that Private Chat conversations were accessed, which is a statement about what it found, not a guarantee about what happened. Fireworks' bulletin is marked as an active-monitoring status, and NEAR AI says regulatory notifications will follow where required. Both companies' own pages are the places to look for updates.