NEAR AI said it detected unauthorized access to part of its infrastructure after attackers exploited a remote code execution flaw in SGLang, the open-source inference engine used on its servers. The company said it has blocked the vulnerability and taken a series of containment steps across its systems.
According to NEAR AI, the incident exposed account information tied to about 100 users and data from 18 AI agents operating in its legacy environment. The company also said two customer API keys from NEAR AI Cloud were exposed and later revoked.
How the breach happened
The company said the attackers gained entry by executing code on one inference server through the SGLang vulnerability. From there, they were able to reach internal infrastructure connected to other services.
NEAR AI said the compromised systems included internal resources related to its discontinued Private Chat service. The company did not say how long the attackers had access, but said the unauthorized activity was detected and the vulnerability was blocked.
What data was exposed
NEAR AI said the downloaded user data included names and email addresses for about 100 users. In some cases, the exposed information also included subscription plan details and balance information.
The company said data from 18 older AI agents was also exposed. That material included chat histories, settings, and logs from those agents.
In addition, NEAR AI said attackers may have been able to view user requests processed on the affected server, including requests handled in confidential mode. At the same time, the company said it found no evidence that stored Private Chat conversations or uploaded files were accessed.
Containment and remediation
After identifying the breach, NEAR AI said it revoked all active sessions and administrator credentials, replaced all agent tokens, and temporarily suspended Private Chat. It also applied the SGLang patch across all inference servers.
The company said API keys belonging to two NEAR AI Cloud customers had been exposed through logs. Those keys have since been revoked, and access to NEAR AI Cloud has been restored.
Notifications and next steps
NEAR AI said affected users have been notified about the incident. It also said regulatory filings are planned where required.
The company’s latest update indicates that the immediate response has focused on cutting off access, rotating credentials, and patching the vulnerable software across its infrastructure. The next confirmed step is the completion of any required regulatory reporting tied to the breach.
Source: en.bloomingbit.io