An incident involving a security vulnerability in SGLang, an open-source inference engine, allowed an attacker to execute code on one of NEAR AI’s inference servers. This breach occurred last Sunday, leading to significant data exposure.
Exploit Details and Impact
NEAR AI reported that the attacker gained access to requests processed on the compromised server, including those handled in confidential mode. This mode is designed to operate within a trusted execution environment (TEE) to maintain privacy, even from NEAR AI itself. However, the company acknowledged that the TEE could not mitigate vulnerabilities in the software running within it, enabling the attacker’s access.
The breach also extended beyond initial access, as the attacker infiltrated an internal system linked to Private Chat, a service NEAR AI has since deprecated. Approximately 100 users’ account information, such as email addresses, names, and some plan and balance details, were accessed. Fortunately, no Private Chat logs or files were compromised.
Further Intrusions and Data Exposure
The attacker also compromised 18 AI agents that operated on an older deployment of NEAR AI Agents, which did not utilize the TEE. Data obtained included chat histories, settings, and logs. Additionally, logs exposed API keys for two NEAR AI Cloud customers, prompting the company to revoke them immediately.
Following the attack detection, NEAR AI implemented several security measures. These included revoking all active sessions and administrator credentials, replacing agent tokens, taking Private Chat offline, and patching the SGLang vulnerability across all inference servers. A comprehensive forensic review was conducted, and NEAR AI Cloud service access was restored.
Response and Future Precautions
NEAR AI has informed affected users, providing guidance via [email protected]. It advised vigilance regarding unsolicited messages related to accounts or balances. Users who were not contacted directly need not take action, as confirmed in a subsequent update.
The flaw has been reported to the SGLang project, though details such as the CVE number or affected versions remain unspecified. NEAR AI has not clarified whether the breached server handled chats operated by Brave’s Leo assistant, which utilizes the GLM 5.3 Flash model within a TEE environment.
This incident highlights the ongoing challenges in securing software running within trusted environments and emphasizes the importance of robust cybersecurity measures.
