- NEAR AI says an attacker used a flaw in the open-source SGLang engine to reach about 100 users' account details and 18 agents.
- The company says confidential computing does not protect against a vulnerability in the software running inside the protected environment.
- Ask AI vendors who patches the inference software, what retired services still hold data, and whether they will tell you if your requests were exposed.
A sealed room is only as sound as what you put in it
Confidential computing promises that data stays private even from the company running the servers. NEAR AI's incident report shows where that promise ends. The company says the protection "does not protect against a vulnerability in the software running inside the environment."
This is the lesson of the incident. A vendor can seal the room, and the room can still hold software with a flaw. The seal keeps out the landlord. It does not vet the furniture.
What NEAR AI says happened
The entry point was a flaw in SGLang, open-source software that runs AI models and answers requests. NEAR AI says an outsider used it to run their own commands on one of its inference servers. That kind of flaw is called remote code execution. The company says the outsider then moved deeper into its infrastructure.
From there, the outsider reached an internal system tied to Private Chat, a product NEAR AI had already retired. NEAR AI confirmed that about 100 users' account details were downloaded. These cover names and email addresses and, for some accounts, plan and balance data.
The outsider also got into 18 agents on a legacy deployment of NEAR AI Agents. NEAR AI says that deployment did not run in its confidential computing environment. The data taken from those agents included chat history, settings and logs.
Separately, two Cloud customers had API keys exposed in logs, and NEAR AI says it revoked both. NEAR AI reports no sign that saved Private Chat conversations or uploaded files were touched.
Why the enclave did not help
The most serious possible exposure is one NEAR AI describes with care. On November 8, the outsider could have watched requests as the compromised server handled them. That includes requests sent in confidential mode. The company says "could have." It has not said the outsider did.
The reason is where SGLang sits. The Hacker News reports that SGLang runs inside the protected environment. A flaw in it puts an attacker inside the seal. By NEAR AI's account, the protected environment is not designed to guard against a flaw in software running within it. The company does not report any failure of the hardware itself.
So the entry point and the confirmed data theft were different things. The entry point was an inference server running SGLang inside the confidential computing environment. The confirmed data came from an internal system of a deprecated product and from a legacy agent deployment that NEAR AI says did not run in its TEE. The confidential computing protection did not stop the attacker from getting in, because the flaw sat in software running inside it.
That is one incident, not a trend. It does show, in NEAR AI's own account, how one foothold reached retired systems. Retired products keep their data until someone removes it, and logs keep whatever was written to them.
What is still unknown
The Hacker News reports that NEAR AI has not given a CVE number for the flaw. It has not named the affected SGLang versions or said if the SGLang project has shipped a fix. NEAR AI says it reported the flaw to the project and deployed its own fix on all inference servers.
Customers of other products have a question too. Brave, the browser maker, published a technical write-up on October 15 describing how its Leo assistant uses a NEAR AI-run protected environment to serve chats from the GLM 5.3 Flash model. The Hacker News says NEAR AI has not stated if the compromised server touched any of that traffic.
NEAR AI later posted that users who have not heard from it need take no action, The Hacker News reports. What remains unclear is whether anyone whose requests passed through the affected server on Sunday was among those it contacted.
Questions to put to your team
Start with the contract. Which AI services handle your data in confidential mode, and does the vendor's promise cover flaws in the software running inside the enclave?
Ask who patches the inference software and how quickly. Ask whether the vendor lists the open-source components it runs. Ask how you would learn that your requests reached an affected server.
Then look at your own estate. Which retired AI tools and pilots still hold account data or agent history? Do your logs contain API keys? NEAR AI's two exposed keys were found in logs.
Confidential computing narrows who can look at your data. It does not narrow the list of software that has to be right.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: NEAR AI.
