SGLang Exploit Breaches NEAR AI Inference and Agent Histories

Key Takeaways

• NEAR AI published an incident report on November 9, 2026, after an attacker exploited a remote code execution flaw in SGLang.
• The attacker took account details for about 100 users and histories, settings and logs from 18 legacy AI agents.
• API keys for two NEAR AI Cloud customers appeared in exposed logs and were revoked.
• Requests processed on the affected server on November 8, including confidential mode requests, may have been visible.

A Confidential AI Service Undone by Its Inference Engine

NEAR AI markets privacy-preserving AI built on confidential computing. Decrypt reported that an attacker bypassed those protections by exploiting SGLang, the open-source engine that runs its models, and then moved into other parts of its infrastructure. The attacker took user account data, legacy agent histories and customer API keys before the company contained the breach.

What We Know

According to the NEAR AI incident report, the attacker used a remote code execution flaw in SGLang to run commands on one inference server on November 8. From there, the intruder reached other internal systems.

Confirmed exposure includes account information for about 100 users. The attacker also retrieved conversation histories, settings and logs from 18 AI agents on an older NEAR AI Agents deployment that did not run in the confidential computing environment. Logs exposed NEAR AI Cloud API keys belonging to two customers.

NEAR AI found no sign that stored Private Chat conversations or uploaded files were accessed. However, it said requests processed on the compromised server on November 8, including confidential mode requests, could have been observed.

NEAR AI did not identify the specific SGLang flaw. Reporting notes there is no basis to link the breach to earlier SGLang disclosures. The company patched SGLang across its inference fleet, revoked sessions and admin credentials, replaced agent tokens and restored Cloud access on November 10.

What Happened

Inference engines sit at the center of AI services. They load models, accept user prompts, and return responses, and they often run with network access to other internal services.

In this case, an attacker reached an SGLang server and used a code execution flaw to run commands on it. That foothold gave access to whatever the server could reach, including systems that stored user accounts and the data of legacy agents.

The agent data is the most AI-specific loss. Conversation histories, settings and logs reveal what agents were asked to do, which tools they used, and in this case which API keys passed through them.

The confidential computing angle matters too. Trusted execution protects data from the host operator, but it cannot protect data from vulnerable software running inside the protected environment. If the inference engine is compromised, requests it handles can be read.

NEAR AI contained the intrusion, took Private Chat offline during response, and notified affected users.

Why It Matters

Open-source inference engines such as SGLang and vLLM now power a large share of AI services, from startups to internal enterprise platforms. They are complex, fast-moving projects, and they expose network services by design.

This breach shows that an inference server is not a dead end for an attacker. It is a foothold with access to prompts, model weights, agent memory and neighboring systems. Segmentation between inference and internal services is often thin.

It also shows the limits of privacy marketing. Confidential computing is valuable, but it reduces one class of risk. The software stack inside the enclave still needs patching, monitoring and least privilege.

Teams running their own inference should track engine versions, isolate inference hosts from internal services, keep agent histories and logs free of secrets, and plan for prompt exposure in incident response. Legacy agent deployments deserve the same scrutiny as current ones. Response plans should cover the possibility that live prompts were visible to an attacker.

PointGuard AI Perspective

NEAR AI's breach started with an inference engine and ended with agent histories and customer keys. Both ends of that chain are places where AI security controls should sit.

PointGuard AI Security Posture Management inventories inference engines, model servers and agent deployments, then flags vulnerable versions, exposed endpoints and weak network boundaries. A legacy agent deployment outside the protected environment, holding logs with customer keys, is exactly the kind of finding posture management is built to surface.

Agent activity also needs a record that does not double as a liability. PointGuard AI Agent Mission Control gives security teams real-time observability into what agents do, which tools they call and which credentials they use, while keeping secrets out of stored transcripts. Behavioral baselines help spot an attacker querying agent data in bulk.

The PointGuard AI Supply Chain Security capability tracks open-source AI components such as SGLang across the environment, so teams know where to patch when a new flaw lands and can prove that every inference host is updated.

The lesson is that the model runtime is part of the attack surface. Securing AI means securing the engine, the agents and the data they leave behind. Runtime monitoring on inference hosts adds a final layer, flagging unexpected processes and outbound connections from model servers.

Incident Scorecard Details

Total AISSI Score: 7.80/10

Criticality: 8, Account data, agent histories and customer API keys were exposed. AISSI weighting: 25%

Propagation: 7, One inference server foothold reached other internal systems. AISSI weighting: 20%

Exploitability: 8, A real attacker gained unauthorized access and took data. AISSI weighting: 15%

Supply Chain: 8, The flaw sits in an externally maintained open-source inference engine. AISSI weighting: 15%

Business Impact: 8, Confirmed customer exposure, revoked keys and a paused service. AISSI weighting: 25%

Sources

Third-Party Sources

• Decrypt: Near AI breach exposes user details and data from 18 AI agents
• NEAR AI: Security incident report, SGLang vulnerability

PointGuard AI Sources

• PointGuard AI Security Posture Management
• PointGuard AI Agent Mission Control
• PointGuard AI Supply Chain Security