NEAR AI’s Cloud inference service is back online after a security review traced a November 8 intrusion to a remote code execution flaw in SGLang, the open-source inference engine used on its servers. The team published its post-mortem on November 9 and said the attacker ran code on one inference server, then reached other parts of the infrastructure.
What the attacker accessed
From that foothold, the intruder connected to an internal system tied to the discontinued Private Chat service. Account information for roughly 100 users was downloaded. The records included email addresses and names, and for some accounts subscription plan and balance details. That is the kind of identity data platforms often collect through KYC checks. The report found no evidence that stored Private Chat conversations or uploaded files were accessed.
Investigators also confirmed unauthorized access to 18 agents running an older version of NEAR AI Agents. Those deployments sat outside the trusted execution environment, or TEE, the hardware-based isolation layer used for confidential computing. Chat histories, configuration settings and operational logs were pulled from those agents. Two Cloud customers had API keys exposed through the logs, and both credentials were revoked. The team said the attacker could have observed requests processed on the compromised server on November 8, including requests in confidential mode. The report does not say how many.
Response and cleanup
NEAR AI suspended Cloud inference after finding the entry point and kept it paused while engineers worked. A later update on X said Cloud infrastructure returned online after fixes were deployed and affected credentials were replaced. Active sessions and administrative credentials were revoked, agent tokens were replaced, Private Chat was taken offline, and the SGLang fix was applied across all inference servers before the remaining rotations finished.
Affected users have been contacted. The team said people who have not heard from it do not need to act. A full forensic review is complete, owners of the 18 compromised agents got individual notices, and regulatory notifications will follow where required. The NEAR Protocol blockchain and other services were unaffected.
The root cause
The report’s clearest point is that a TEE cannot fix a bug inside the application it protects. Confidential computing blocks access from outside the protected environment. It does not stop vulnerabilities in the software running within it. The issue has been reported to the SGLang maintainers, and future security reviews will cover inference software, related services, dependencies and deployment configurations.
The incident exposed metadata rather than money. Nothing in the report suggests a private key or custodial holding left the platform’s control. The 100 users with exposed names and emails are likelier phishing targets, so caution around messages that mention balances or account details is warranted. As of the November 10 updates, Private Chat remained offline and the credential rotations were complete.
