NEAR AI breach went through an SGLang bug, and the enclave did not stop it

NEAR AI, which runs a cloud for private AI inference inside hardware enclaves, says an attacker got in through a remote code execution flaw in SGLang, the open-source inference engine on its servers. Its incident report, dated 9 November, says the access is closed, credentials are replaced, the flaw is fixed on every inference server, and NEAR AI Cloud is back online.

What NEAR AI says was reached

• One inference server first. The SGLang bug gave the attacker code execution on one server, and from there access to NEAR AI’s infrastructure.
• About 100 user accounts. From an internal system behind the already deprecated Private Chat, the attacker downloaded email addresses and names, and for some accounts plan and balance details. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.
• 18 legacy agents. Agents on an older NEAR AI Agents deployment, which did not run in NEAR AI’s confidential computing environment, had their chat history, settings and logs taken. Two Cloud customers had API keys sitting in those logs; both keys are revoked.
• Live requests. On 8 November, NEAR AI says, the attacker could also have observed user requests being processed on the compromised server, including requests running in confidential mode. It has not said how many.

The enclave point

NEAR AI is unusually direct about this. “Confidential computing protects data from the operator and the host,” the report says. “It does not protect against a vulnerability in the software running inside the environment.” The SGLang flaw ran code inside the inference server, so requests being processed there were exposed whatever the hardware promised.

That matters because NEAR AI’s confidential inference is also used by others; we covered Brave Leo routing private chats through it. The company says it now treats the inference software and the services around the enclave with the same rigour as the enclave itself, and that its confidential stack’s code and configs stay public.

The SGLang side

NEAR AI says it reported the flaw to the SGLang project. As of 10 November we found no public SGLang security advisory or CVE for it, and the latest release, v0.5.23, is from 2 November. So it is not yet clear which versions are affected or whether the fix is upstream.

Why this matters

SGLang is a widely used open-source serving engine; llm-d coordinates it alongside vLLM. Until an advisory appears, keep SGLang servers off the public internet, put auth in front of them, and give the serving process no credentials beyond what it needs, since here one server led to internal systems. If you buy “confidential” inference, ask the provider how it patches the serving engine, not only which enclave it uses. It lands the same week Fireworks widened its own breach disclosure.