Near AI breach turns its privacy promise into a very public cloud incident ☁️

Near AI disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running on its servers. In a November 9 report, the company said the attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models and generates responses to user requests, allowing commands to be executed on one inference server before the intruder reached other parts of Near AI’s infrastructure.

Investigators traced the intrusion to an internal system connected to Private Chat, a feature Near AI had already retired. The attacker downloaded names and email addresses for approximately 100 users, along with subscription plan and account balance information for some of them. Another 18 agents were accessed on an older deployment of Near AI Agents, where the attacker retrieved chat histories, settings and logs; those agents were not running inside NEAR AI’s confidential computing environment, which is designed to shield information from the company operating the servers.

Logs also exposed NEAR AI Cloud API keys belonging to two customers. Near AI said it revoked both keys but did not say whether the attacker used them. The company found no indication that stored Private Chat conversations or uploaded files had been accessed. The confirmed theft involved account records and legacy agent data, while exposure of live confidential requests remained a possibility identified in the investigation.

Near AI, part of the broader Near ecosystem, has promoted AI privacy alongside its blockchain ambitions. Its Cloud product uses trusted execution environments, or TEEs, to keep AI prompts encrypted and isolated from server operators even while models process them. “It does not protect against a vulnerability in the software running inside the environment,” Near AI acknowledged, explaining that the SGLang flaw let the attacker run code where confidential requests were being processed.

In October, Near AI announced that Brave’s Leo browser assistant was using its confidential inference infrastructure for a supported AI model, although the incident report did not identify Brave users among those affected. SGLang had also attracted scrutiny from security researchers: in July, Carnegie Mellon University’s CERT Coordination Center documented six vulnerabilities, including bugs that could let attackers execute commands or expose credentials, depending on server configuration. Near AI did not identify the specific SGLang flaw exploited in the incident, so the breach cannot be linked to any of those earlier disclosures.