Near AI said in a November 9 report that a breach exposed account information belonging to about 100 users and data from 18 AI agents. An attacker exploited software running the company’s servers. This account follows Decrypt’s report of that disclosure, published November 11, 2026, and does not treat the incident as a new development.
How the intrusion was described
The company said the attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models and generates responses to user requests. The exploit allowed the intruder to execute commands on one inference server and then reach other parts of Near AI’s infrastructure.
Investigators traced the intrusion to an internal system connected to Private Chat, a feature the company had already retired.
What was taken, and what was not confirmed
The attacker downloaded names and email addresses for approximately 100 users, along with subscription-plan and account-balance information for some of them. Another 18 agents were accessed on an older deployment of Near AI Agents. There, the attacker retrieved chat histories, settings, and logs. Those agents were not running inside NEAR AI’s confidential computing environment, which is designed to shield information from the company operating the servers.
Logs also exposed NEAR AI Cloud API keys belonging to two customers. The keys function like credentials that applications use to access cloud services. Near AI said it revoked both. It did not say whether the attacker used them.
Near AI found no indication that stored Private Chat conversations or uploaded files had been accessed. The confirmed theft involved account records and legacy agent data. Exposure of live confidential requests remained a possibility identified by the investigation, not a confirmed result.
The confidential-AI claim, and its software limit
Near AI is part of the broader Near ecosystem, which has promoted AI privacy alongside its blockchain ambitions. Its Cloud product uses trusted execution environments, or TEEs, to keep AI prompts encrypted and isolated from server operators even while models process them.
Hardware isolation does not guarantee that the software inside the protected environment is safe. “It does not protect against a vulnerability in the software running inside the environment,” Near AI acknowledged, explaining that the SGLang flaw let the attacker run code where confidential requests were being processed. The awkwardness is specific: privacy is the product’s core claim, and the reported failure was in software handling those requests.
In October, Near AI announced that Brave’s Leo browser assistant was using its confidential inference infrastructure for a supported AI model. The incident report does not identify Brave users among those affected. The October announcement and this breach notice therefore do not, on the published record, show that Leo users were part of the exposed set.
Earlier SGLang research, without a matched bug
SGLang had already attracted scrutiny from security researchers. In July, Carnegie Mellon University’s CERT Coordination Center documented six vulnerabilities in the project, including bugs that could let attackers execute commands or expose credentials, depending on how servers were configured.
Near AI did not identify the specific SGLang flaw exploited in this incident, so there is no basis to link the breach to any of those earlier disclosures. It reported the vulnerability to SGLang’s developers.
Containment
“On detection, we revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers,” the project said.
It added that it had completed the rotation of all remaining credentials and a full forensic review, had notified users whose account details or agents it confirmed were accessed, and would make any regulatory notifications that were required.
Near AI also warned users to be wary of unsolicited messages referring to their Near AI accounts or balances, and it contacted the owners of all 18 affected agents individually.
The disclosure is evidence about a privacy product’s boundary, not a measure of how widely confidential inference has been adopted. A retired chat feature, an older agent deployment outside the confidential environment, and a flaw in software running on inference servers are different layers. Confirmed exposure covers account records for roughly 100 users and data from 18 legacy agents; whether live confidential requests were exposed is still only a possibility the investigation identified.
Original article: Decrypt, published November 11, 2026. The company report cited in that account is dated November 9.
