Near AI Discloses Breach Affecting User Data and 18 AI Agents

Near AI has confirmed a security breach involving the exposure of account details for approximately 100 users and data from 18 AI agents. While users often search for information regarding their local environment, such as the nearest beach or digital service, this incident highlights the risks inherent in software infrastructure. The company reported on November 9 that an attacker exploited a remote code execution vulnerability within SGLang, an open-source engine utilized to run AI models and process user queries.

A software flaw in the SGLang engine allowed attackers to access user accounts and sensitive AI agent data.

Investigators determined that the intruder utilized the SGLang exploit to execute commands on an inference server, eventually gaining access to other segments of the Near AI infrastructure. The breach was traced to an internal system linked to Private Chat, a feature that had been previously retired. During the intrusion, the attacker successfully downloaded names and email addresses for about 100 users, alongside information regarding subscription plans and account balances for some individuals. Furthermore, 18 agents hosted on an older deployment were accessed, resulting in the exposure of chat histories, settings, and logs.

Notably, the affected agents were not operating within the company’s confidential computing environment, which is designed to provide hardware-backed isolation from server operators. The breach also exposed two Near AI Cloud API keys, which the company has since revoked. Near AI stated that there is no evidence that stored Private Chat conversations or uploaded files were accessed, though the possibility of exposure regarding live confidential requests remains under investigation.

Security and Hardware Limitations

Near AI promotes privacy through the use of trusted execution environments (TEEs) to keep prompts encrypted. However, the company acknowledged that hardware isolation does not automatically protect against vulnerabilities within the software running inside those environments. The SGLang flaw allowed the attacker to execute code in a space where confidential requests were being processed. Upon discovery, the project revoked all active sessions and administrative credentials, replaced agent tokens, and deployed a patch across all inference servers. Affected users have been notified, and the company is conducting a full forensic review to ensure security integrity.

Why it matters

This incident underscores the limitations of hardware-based privacy protections when the underlying software remains vulnerable. It serves as a reminder that even systems marketed on privacy-centric architectures are susceptible to exploits if the software components—like the SGLang engine—contain security flaws. For users, the breach highlights the necessity of remaining vigilant against unsolicited communications regarding account credentials or financial balances.