NEAR AI

Summary

An attacker exploited a remote code execution flaw in the SGLang inference software used by NEAR AI to access a single inference server and move into internal infrastructure, exposing names and email addresses of about 100 users along with plan and balance details for some, chat histories, settings and logs from 18 agents on an older deployment, and API keys for two cloud customers that were subsequently revoked. The breach did not involve the underlying blockchain, wallets, private keys, or stolen coins, and the company revoked sessions, replaced agent tokens, took a discontinued chat feature offline, patched the inference servers, and rotated remaining credentials after discovering the intrusion.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 9, 2026, NEAR AI published an incident report disclosing that an attacker had exploited a remote code execution vulnerability in SGLang, the open-source inference software the company uses to run language models on its own servers. The flaw allowed the intruder to execute commands on a single inference server and then move further into the company's infrastructure. From that position, the attacker reached an internal system behind Private Chat, a feature that NEAR AI had already discontinued. The intruder also accessed 18 agents hosted on an older deployment of NEAR AI Agents, a platform that did not run those agents in the confidential computing environment the company otherwise promotes. The report does not identify the specific SGLang vulnerability that was exploited, though NEAR AI stated it had reported the issue to the SGLang developers. The CERT Coordination Center at Carnegie Mellon University had previously flagged vulnerabilities in SGLang in July, including flaws that could permit command execution or credential reading depending on server configuration, but it remains unclear whether the attacker used one of those flaws. The trade outlet Decrypt picked up the report on November 10.

The confirmed data accessed included the names and email addresses of approximately 100 users, with some records also containing plan information and account balance, where balance refers to credit deposited with NEAR AI for model calls or subscriptions rather than a blockchain wallet or private key. The attacker obtained chat histories, settings, and logs from the 18 agents on the older deployment. Logs also contained the NEAR AI Cloud API keys of two cloud customers, both of which were revoked, though the report does not state whether the attacker used them. A residual risk applies to November 8, when the attacker could have observed requests being processed on the compromised server in real time, including requests in confidential mode, although NEAR AI found no evidence of access to stored Private Chat conversations or uploaded files. The incident did not involve stolen coins, wallets, private keys, or drained tokens, and the NEAR Protocol blockchain, its validators, and its smart contracts were not affected. NEAR AI is operated by Jasnah Inc. and sells private AI computing power, making it a service provider separate from the layer-1 NEAR Protocol blockchain. This incident is distinct from a separate event in late September when NEAR Intents halted withdrawals following an exploit of approximately $3.8 million.

After discovering the breach, NEAR AI revoked all active sessions and administrator access, replaced every agent token, took Private Chat offline, and patched the SGLang flaw on all inference servers. The company rotated all remaining credentials, completed a forensic review, and restored access to NEAR AI Cloud. The exposed names, email addresses, and account balances could be used to construct phishing messages that appear credible because they reference real user details and paying-customer status. According to CoinGecko, NEAR traded at €3.19 on Tuesday evening, roughly two percent below the previous day and about 37 percent below its level 30 days ago, a decline that began before the report and followed the weak overall market rather than the disclosure itself.

Sources

Sources available to members: 1 source.