NEAR AI Says SGLang Flaw Exposed User and Agent Data

NEAR AI says an attacker exploited a vulnerability in the SGLang inference engine on November 8, gaining access to an inference server and internal systems and downloading information linked to about 100 users and 18 older AI agents. The company said it patched its servers, completed a forensic review and restored access to NEAR AI Cloud.

According to the company’s incident report, the attacker used a remote-code-execution flaw to run code on one inference server, then reached an internal system connected to Private Chat, a feature NEAR AI had discontinued. The intruder downloaded names and email addresses for about 100 users, along with plan and account-balance information for some of them.

NEAR AI said the attacker also accessed 18 agents running on an older deployment of NEAR AI Agents. Data taken from those agents included chat histories, settings and logs. Logs exposed API keys belonging to two NEAR AI Cloud customers; the company said it revoked both keys.

The company said the attacker could have observed requests processed on the compromised server on November 8, including requests handled in confidential mode. That possibility does not establish that requests were...