In a report dated November 9, 2026, NEAR AI, which sells private inference on open models inside hardware enclaves, said it had "identified and contained unauthorized access to part of its infrastructure". The attacker "exploited a remote code execution vulnerability in SGLang, the open-source inference engine running on our servers", which "gave them code execution on one inference server and, from there, access to our infrastructure."
What NEAR AI says was reached
- Account details. The attacker reached "an internal system behind previously deprecated Private Chat" and downloaded email addresses, names and, for some accounts, plan and balance information for about 100 users.
- Legacy agents. There was access to 18 agents on a legacy deployment "which were not running in NEAR AI's confidential computing (TEE) environment", including their chat history, settings and logs.
- Keys in logs. "Two Cloud customers had NEAR AI Cloud API keys exposed in logs." Those keys have been revoked.
- Requests in flight. "On November 8, they could also have observed user requests being processed on the accessed server, including requests running in confidential mode." NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.
NEAR AI says it revoked sessions and administrative credentials, replaced agent tokens, took Private Chat offline, deployed a fix across all inference servers and reported the flaw to the SGLang project. It has not identified the vulnerability publicly, and we found no matching SGLang advisory, so this entry does not link it to any earlier SGLang CVE. Decrypt reported the incident on November 10.
What an enclave does and does not cover
NEAR AI's report puts it plainly: "Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here." Attestation can prove which inference stack is running. It cannot prove that the stack has no bugs. NEAR AI says it is now treating "the inference software and the services around the enclave with the same rigor as the enclave itself".
What remains uncertain. We do not know which SGLang feature or version was involved, whether other SGLang deployments are exposed, or how many confidential requests were actually read rather than merely observable.
Analysis: If Tanishka's team at Belgavi's Book Store sends customer CASE notes to a confidential-inference provider, the enclave is only the outer wall. Ask which serving engine runs inside it, how fast that engine is patched, and whether its network-facing features are switched off. Two smaller lessons apply to any deployment: retire old systems instead of leaving them reachable, and keep API keys out of logs, since in this incident both turned a single server compromise into user and customer exposure.
Sources and evidence
NEAR AI says an SGLang remote code execution bug gave an attacker code execution on one inference server, access to about 100 users' account details, 18 legacy agents and two logged API keys, and a view of in-flight requests, including confidential ones, on November 8. The flaw is unnamed. Enclaves protect against the host, not the software inside them.