NEAR AI, an AI infrastructure provider, has revealed in a security incident report that an attacker broke into one of its AI servers and downloaded customer information from other parts of its systems. The company said the intruder could also have seen confidential AI requests processed on that server on Nov. 8.
According to the firm, the attacker exploited a flaw in SGLang, open-source software that handles requests sent to AI models. It allowed the intruder to run code on one server and then reach other systems belonging to NEAR AI.
From an internal system behind its deprecated Private Chat service, the attacker downloaded account details for approximately 100 users. These included names and email addresses and, in some cases, plan and balance information. NEAR AI said it found no sign that stored Private Chat conversations or uploaded files were accessed.
The intruder also retrieved conversation histories, settings and logs from 18 AI agents on an older deployment of the company’s NEAR AI Agents service. These AI assistants were not running in its confidential computing environment. API keys belonging to two NEAR AI Cloud customers were also exposed in logs. Those keys, used to authenticate access to NEAR AI Cloud, have since been revoked.
How confidential requests were at risk
NEAR AI offers confidential AI processing to keep requests hidden from the people and companies operating its servers. It processes requests inside a hardware-isolated environment that, according to the company, prevents the server operator and NEAR AI itself from reading them.
But the software inside that protected area still has to read the request to generate an answer. In this case, the attacker exploited a flaw in that software, SGLang, allowing code to run where requests were being processed. NEAR AI said the intruder could therefore have seen requests sent through its confidential mode.
NEAR AI says it patched its servers
The company said it closed the unauthorized access, revoked active sessions and administrative credentials, replaced agent tokens and took Private Chat offline. It also fixed the SGLang flaw on all its inference servers and restored NEAR AI Cloud access.
NEAR AI said it completed a forensic review and notified users whose account details or agents it confirmed were accessed. It advised users to be cautious of unexpected messages mentioning their accounts or balances.
NEAR AI has reported the vulnerability to the SGLang project, but its disclosure does not provide a vulnerability identifier or specify which software versions are affected. The report does not specify how long the attacker had access or how many confidential requests passed through the compromised server. Whether any of those requests were actually viewed remains unknown.