NEAR AI discloses security breach after SGLang vulnerability exposed user data, 18 legacy AI agents and two customers' API keys

NEAR AI says an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, gaining code execution on one inference server and broader infrastructure access. The party downloaded account details—emails, names, and for some, plan and balance data—for roughly 100 users from a deprecated Private Chat system, and accessed 18 agents on a legacy non-TEE deployment, exposing chat history, settings and logs. Two Cloud customers' API keys appeared in logs and were revoked. On November 8, requests in processing, including confidential ones, could have been observed. NEAR AI revoked sessions, rotated credentials, patched the vulnerability, and notified affected users.

✨ AI summary of the linked source — not editorial content.

Explore the topic

• AI Agents
• API
• NEAR
• vulnerability