SECURITY ALERT

The enclave held.

The software inside it did not.

NEAR AI, the NEAR ecosystem’s unit for AI products and infrastructure, says an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, and downloaded account details for about 100 users, according to the company’s incident report dated 9 Nov.

The same intrusion reached 18 AI agents on a legacy deployment and exposed two cloud customers’ API keys, the report says.

NEAR AI says the hole is patched and its cloud service is back.

How far can one inference server reach?

What NEAR AI says happened

The flaw gave the attacker code execution on one inference server. From there, the report says, they reached an internal system behind Private Chat, a feature NEAR AI had already deprecated.

That system gave up email addresses and names, and for some accounts plan and balance information, for roughly 100 users.

Separately, the attacker got into 18 agents on an older deployment of NEAR AI Agents that was not running inside NEAR AI’s confidential computing environment, a trusted execution environment (TEE) designed to shield data from the machine’s operator. For those agents, chat history, settings and logs were taken.

API keys belonging to two NEAR AI Cloud customers were sitting in those logs. Both keys have been revoked, the company says.

What were API keys doing in agent logs?

The confidential-mode caveat

This is the part worth reading twice.

On 8 Nov, the report says, the attacker may also have been able to see user requests as that server handled them, confidential-mode requests included.

NEAR AI is candid about why. Confidential computing “does not protect against a vulnerability in the software running inside the environment”, it wrote, “and that is what happened here.”

It says it has seen no sign that saved Private Chat conversations or uploaded files were touched. It does not say how many requests passed through the server while it was exposed.

If the inference engine is inside the trust boundary, who audits the inference engine?

The response

NEAR AI says it cut off every active session and administrative credential, issued new agent tokens, took Private Chat offline and deployed a fix for the SGLang flaw across all inference servers. It says credential rotation and a full forensic review are complete.

It has told the SGLang project about the flaw and says it will make any regulatory notifications required. Affected users and the 18 agent owners have been contacted individually, from [email protected].

The NEAR blockchain and the ecosystem’s other services were unaffected, crypto.news reported. NEAR AI Cloud, paused during the investigation, has been restored, The Block reported.

No attacker has been named, and we do not name one.

What is not known yet

The report gives no CVE number for the SGLang flaw and no time of detection. It does not say whether other operators running SGLang are exposed, or whether a patched SGLang release is public yet.

Protect yourself

  • If you had a NEAR AI account, treat any unsolicited message about your account or balance as a phishing attempt unless it comes from [email protected], as the company itself advises.
  • If you used NEAR AI Cloud, rotate your API keys even if you were not told yours was exposed.
  • If you run SGLang yourself, watch the project’s repository for a security fix and apply it before exposing an inference server to untrusted input.
  • Do not paste wallet seed phrases or private keys into any AI chat or agent, confidential mode or not.

It is the second incident in a week in which a login or AI layer, not a smart contract, was the weak point, after Web3Auth’s recovery wallets. Researchers have already shown AI agents raised their own wallet spending caps when given the chance.

How much of crypto’s AI stack is trusted because it runs in an enclave, rather than because anyone has read the code?

Corrections and new evidence: [email protected]

Related: Binance warned that an iOS flaw called worse_query can let malicious apps read wallet seed phrases

Related: Node provider Chainstack says an attacker got in through a test server left on its default password

This article is for information only and is not investment advice.