NEAR AI Breach via SGLang Exposes Data of About 100 Users

NEAR AI, the AI platform in the NEAR ecosystem, has disclosed a breach of its infrastructure. On November 8, 2026, an attacker exploited a remote code execution flaw in SGLang, an open-source engine for running AI models, and reached an inference server. The company says it detected and contained the intrusion by November 9. Data of about 100 users and 18 legacy AI agents was affected.

Details

According to the NEAR AI incident report, names and email addresses of roughly 100 users were exposed, and for some accounts also plan and balance information. For 18 legacy agents, the attacker obtained chat histories, settings and logs. Two Cloud API keys leaked into logs and have been revoked. The company also says user requests, including those in confidential mode, may have been observable during November 8.

After detection, NEAR AI revoked all active sessions and administrative credentials, replaced agent tokens, took Private Chat offline and patched the flaw on all inference servers. Credential rotation and a forensic review are complete, and affected users were notified directly. The report does not mention stolen funds and gives no CVE number. Decrypt was first to cover it.

What this means for the market

The incident highlights a weak spot of private AI services: hardware isolation (TEEs) does not protect against a bug in the software running inside it, as NEAR AI itself acknowledges.

The scale is small and no direct crypto losses are reported. Users of the service would be wise to change passwords and check API keys. This is not investment advice. For the current market picture, see the daily brief.