---
type: "post"
id: "near-ai-incident-report-sglang-remote-code-execution-46e998"
slug: "near-ai-incident-report-sglang-remote-code-execution-46e998"
title: "NEAR AI incident report: SGLang remote code execution let attacker into inference servers, including requests processed in confidential mode"
description: "NEAR AI says an attacker used a remote code execution vulnerability in SGLang to access one inference server and reach internal systems."
retrieval_nugget: "NEAR AI says an attacker used a remote code execution vulnerability in SGLang to access one inference server and reach internal systems."
published_at: "2026-11-10"
updated_at: "2026-11-10"
record_date: "2026-11-10"
date_kind: "published_at"
topics: ["inference"]
entities: ["NEAR AI","SGLang","NEAR AI Cloud","NEAR AI Agents","Private Chat"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "NEAR AI reports a separate SGLang remote-code-execution breach, including exposure of account data, legacy agents and potentially requests processed in confidential mode."
prior_refs: ["https://newruntime.com/posts/a-configuration-mismatch-in-glm-5-3-on-8c8082/"]
source_url: "https://near.ai/blog/security-incident-report-sglang-vulnerability"
source_urls: ["https://near.ai/blog/security-incident-report-sglang-vulnerability"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:near-ai-incident-report-sglang-remote-code-execution-46e998"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/near-ai-incident-report-sglang-remote-code-execution-46e998/","markdown":"https://newruntime.com/posts/near-ai-incident-report-sglang-remote-code-execution-46e998.md","json":"https://newruntime.com/posts/near-ai-incident-report-sglang-remote-code-execution-46e998.json"}
markdown_url: "https://newruntime.com/posts/near-ai-incident-report-sglang-remote-code-execution-46e998.md"
---

# NEAR AI incident report: SGLang remote code execution let attacker into inference servers, including requests processed in confidential mode

## Retrieval answer

NEAR AI says an attacker used a remote code execution vulnerability in SGLang to access one inference server and reach internal systems.

## Summary
NEAR AI says an attacker used a remote code execution vulnerability in SGLang to access one inference server and reach internal systems. The company reports that requests processed on the server, including requests in confidential mode, could have been observed. The incident is a reminder that confidential computing does not remove the need to secure the software running inside its boundary.

## What happened
NEAR AI’s security incident report, dated November 9, 2026, says the company recently identified and contained unauthorized access to part of its infrastructure. The attacker exploited a remote code execution vulnerability in SGLang, the open-source inference engine running on NEAR AI’s servers. According to the report, the exploit gave the attacker code execution on one inference server and a path from there into the company’s infrastructure.

NEAR AI’s investigation found that the attacker reached an internal system behind the company’s previously deprecated Private Chat service. The attacker downloaded account details for approximately 100 users: email addresses and names, and, for some accounts, plan and balance information. The company says it found no indication that stored Private Chat conversations or uploaded files were accessed. That distinction is important: the report describes exposure of account details, but does not report access to those stored conversation records or files.

The report also identifies access to 18 agents on a legacy deployment of NEAR AI Agents. Those agents were not running in NEAR AI’s confidential computing environment. Data retrieved for them included chat history, settings and logs. In addition, two NEAR AI Cloud customers had API keys exposed in logs; NEAR AI says it revoked those keys. The company says that on November 8 the attacker could also have observed user requests being processed on the accessed inference server, including requests being handled in confidential mode. The report does not say that all confidential requests or all servers were affected.

NEAR AI says it revoked active sessions and administrative credentials, replaced agent tokens, took Private Chat offline and deployed a fix for the SGLang vulnerability across all inference servers. It reports completing the rotation of remaining credentials and a full forensic review, and says it restored access to NEAR AI Cloud. The company notified users whose account details or agents it confirmed were accessed and says it will make any required regulatory notifications. It also says it reported the vulnerability to the SGLang project. NEAR AI’s explanation is that confidential computing protects data from the operator and host, but does not protect against a vulnerability in software running inside the environment.

## What the archive adds
New Runtime’s earlier coverage described a separate Cloudflare Workers AI incident in which a GLM-5.3 configuration mismatch triggered an SGLang bug that exposed KV cache pages across requests ([the earlier note](https://newruntime.com/posts/a-configuration-mismatch-in-glm-5-3-on-8c8082/), October 27, 2026). This is a new event, not a continuation of that incident: the affected service and reported exposure differ. The shared SGLang component makes the two incidents relevant to the same infrastructure risk, without establishing that their vulnerabilities or causes are connected.

## Trend signal
This incident supports the pattern that agent and inference security depends on the runtime boundary, not only on prompts or hardware isolation ([Agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/)). NEAR AI says code execution in inference software let an attacker reach requests in processing despite confidential computing protections. That is a concrete illustration of the pattern, not evidence that enclave protections are ineffective: the report’s point is that software inside the enclave and services around it also require security analysis.

## Why now
The report says the attacker could have observed requests on November 8 and is dated November 9, 2026. NEAR AI presents the response as completed: the SGLang vulnerability was fixed across inference servers, credentials were rotated and Cloud access restored. The timing matters for customers assessing what may have been exposed and for operators reviewing their own inference software and logs.

## Why it matters
Confidential inference is often discussed as protection against a cloud operator or host inspecting data. NEAR AI’s account draws a narrower but operationally important boundary: hardware-enforced isolation cannot by itself prevent vulnerable software running within the environment from being exploited. For teams building on confidential inference, this means the trust question includes the inference engine, its dependencies, deployment configuration, logs and the services surrounding the enclave.

The report also shows why incident response must distinguish data types and paths. Stored conversations and uploaded files were not reported accessed, while in-flight requests on one server could have been observed; legacy agents and credentials in logs created separate exposure paths. Teams should therefore map which information is stored, processed, logged and reachable from each runtime, then ensure a vulnerability in one component does not make every category equally accessible. NEAR AI says its confidential stack’s code, dependencies and deployment configurations remain public for verification. That can aid scrutiny, but it is not a substitute for patching, credential rotation or independent assessment.

## Limits and uncertainty
These details are NEAR AI’s account of its investigation; they have not been independently verified here. The company describes access to one inference server and says requests processed there, including confidential-mode requests, could have been observed, but does not quantify how many requests or identify their contents. It does not report evidence that stored Private Chat conversations or uploaded files were accessed. The report does not identify the attacker, give technical details of the SGLang vulnerability or name a fixed version. It also does not quantify the duration of access or disclose the consequences, if any, for individual users beyond the categories of data described.

## Skill to build now
If your team runs SGLang or another inference engine inside a confidential-computing environment, map which secrets and request data are available to that process and which may be written to logs. Review the engine’s security advisories and deployed version, and establish a procedure to revoke credentials exposed in logs. NEAR AI says it deployed a fix across its inference servers, but the report does not specify a version number, so operators should confirm the applicable remediation with the relevant project or vendor rather than assume a particular release.

## Reader takeaway
An enclave can protect data from the host while still leaving it exposed to a software vulnerability inside the enclave. Treat the inference runtime, dependencies, configuration and logs as part of the confidential-computing security boundary, and verify the specific fixes and exposure paths relevant to your own deployment.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Inference](https://newruntime.com/topics/inference.md): Explore the inference topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)