NEAR AI Security Breach Exposes 100 User Accounts and 18 Agents Through SGLang Flaw

NEAR AI Security Breach Raises Concerns About Confidential AI Infrastructure

The NEAR AI security breach has exposed weaknesses in AI inference infrastructure after an attacker exploited a software vulnerability to gain unauthorized access to the platform's internal systems.

According to NEAR AI's official security incident report, published November 9, 2026, the attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine running on the company's servers.

The vulnerability allowed unauthorized code execution on one inference server.

From that initial access, the attacker reached additional internal infrastructure, including a system associated with NEAR AI's previously deprecated Private Chat service.

Investigators confirmed that account information belonging to approximately 100 users was downloaded.

The attacker also accessed 18 AI agents operating on a legacy deployment outside the platform's confidential computing environment.

Two NEAR AI Cloud customers had API keys exposed through agent logs.

The company subsequently revoked those keys and implemented additional security measures.

The incident is particularly important because NEAR AI promotes confidential computing as a way to protect sensitive information during AI processing.

Although the company says its underlying blockchain remained unaffected, the breach demonstrates that hardware-based privacy protections do not eliminate vulnerabilities in the software running inside protected environments.

What Happened During the NEAR AI Security Breach?

The attack began with a vulnerability in SGLang.

SGLang is an open-source system used to run and serve large language models.

AI platforms use inference engines to process prompts and generate responses.

Because inference servers handle incoming requests, they form an important part of an AI provider's operational infrastructure.

In this case, the attacker exploited a remote code execution flaw.

Remote code execution allows an unauthorized party to run software instructions on a vulnerable system.

Depending on the privileges available, such access can allow attackers to inspect files, execute commands, or reach other internal services.

NEAR AI confirmed that the vulnerability provided code execution on one inference server.

The attacker then moved beyond that initial system.

How the Attack Progressed

Based on NEAR AI's published findings, the incident involved several stages.

The company has not publicly identified the attacker.

It also has not established a confirmed financial loss associated with the incident.

Therefore, the breach should not be described as a cryptocurrency theft or a direct compromise of the NEAR blockchain.

What User Information Was Exposed?

NEAR AI confirmed that the attacker downloaded account details belonging to approximately 100 users.

The exposed information included email addresses and names.

For some accounts, the records also contained subscription plan and balance information.

Although these details are not equivalent to cryptocurrency private keys, they can still create security risks.

Email addresses and account information may be used in targeted phishing campaigns.

For example, an attacker could send messages impersonating NEAR AI support and reference an individual's account plan or balance.

Such information can make fraudulent messages appear more credible.

Why Account Balance Information Matters

Account balance details can reveal information about a user's relationship with a service.

Even when the information does not provide direct access to funds, it may help attackers identify potentially valuable targets.

Users whose information was exposed should therefore be cautious about unexpected messages requesting account verification, password changes, or credential disclosure.

NEAR AI says it has contacted users whose account information was confirmed to have been accessed.

The company also advises customers to treat unsolicited messages referring to their account or balance with caution.

Attackers Accessed 18 Legacy AI Agents

The incident affected more than ordinary account records.

NEAR AI confirmed unauthorized access to 18 agents running on an older NEAR AI Agents deployment.

These agents were not operating inside the company's confidential computing environment.

The attacker retrieved chat histories, settings, and operational logs associated with those agents.

This distinction matters because AI agents can store or process information beyond a single conversation.

Depending on their configuration, agents may interact with external services, execute automated tasks, or maintain records of previous activity.

Why Agent Logs Can Be Sensitive

Operational logs are useful for troubleshooting and monitoring AI applications.

However, they may also contain sensitive information.

For example, a log could include application configuration details, request metadata, or credentials if the system does not properly filter sensitive values.

NEAR AI confirmed that two Cloud customers had API keys exposed in the accessed logs.

The company revoked those keys.

The incident demonstrates why developers should avoid recording sensitive credentials in application logs.

It also highlights the importance of separating legacy applications from current production infrastructure.

Two NEAR AI Cloud API Keys Were Exposed

API keys are credentials used by applications to authenticate requests to online services.

Developers commonly use them to connect software with AI platforms.

If an unauthorized party obtains an active API key, that party may be able to make requests using the associated account's permissions.

The consequences depend on the key's access scope, spending limits, and available services.

In the NEAR AI incident, two customers' Cloud API keys were exposed through legacy agent logs.

NEAR AI says both keys have been revoked.

The company also replaced agent tokens and rotated other affected credentials.

Why Credential Rotation Is Important

Revoking an exposed key prevents it from being used for future authorized access.

However, revocation does not undo any activity that may have occurred before the key was disabled.

That is why security investigations also examine access logs and unusual activity.

NEAR AI has not publicly established that the exposed API keys were used to carry out additional attacks.

The confirmed fact is that the credentials were exposed and subsequently revoked.

Could Attackers See Confidential AI Prompts?

One of the most important findings concerns confidential AI processing.

NEAR AI says the attacker could have observed user requests being processed on the compromised inference server on November 8.

This includes requests operating in confidential mode.

However, the company has not disclosed how many requests were actually observed.

It also has not established that every confidential request processed by the platform was exposed.

The distinction between potential access and confirmed data retrieval is important.

Stored Conversations Were Not Confirmed Compromised

NEAR AI reported finding no indication that stored Private Chat conversations or uploaded files were accessed.

This is different from the confirmed access to chat histories belonging to the 18 legacy agents.

The two findings should not be combined.

The affected legacy agents had their histories and logs retrieved.

By contrast, NEAR AI says it found no evidence that stored conversations or uploaded files from its deprecated Private Chat service were accessed.

However, requests actively being processed on the compromised inference server may have been observable.

That limitation raises important questions about the security of confidential AI workloads.

Why the SGLang Vulnerability Matters for Confidential Computing

NEAR AI uses confidential computing technology to protect sensitive information during AI inference.

Confidential computing often relies on trusted execution environments, commonly called TEEs.

These environments use hardware-based isolation to help protect data while it is being processed.

The goal is to reduce the ability of infrastructure operators or other software running outside the protected environment to access sensitive workloads.

However, confidential computing does not make every application running inside the protected environment immune to attack.

The Difference Between Hardware Isolation and Software Security

Consider a simplified example.

A company operates an AI model inside a hardware-isolated environment.

The hardware prevents certain outside systems from inspecting the model's processing memory.

However, the AI inference application itself contains a vulnerability.

If an attacker exploits that vulnerability and gains code execution inside the protected environment, the attacker may be able to interact with data available to that application.

The hardware isolation has not necessarily failed.

Instead, the trusted software inside the environment has been compromised.

That is the central lesson of the NEAR AI incident.

The SGLang vulnerability allowed code execution within the inference system.

As a result, requests being processed by that system could potentially be observed.

Confidential Computing Is Not Complete Protection

Trusted execution environments can provide meaningful security benefits.

However, they are only one part of a secure system.

AI platforms must also protect application code, software dependencies, authentication systems, logs, and network services.

The NEAR AI incident demonstrates that weaknesses in any of these components can undermine the confidentiality of a workload.

For companies developing AI services that handle sensitive financial or personal information, this is an important consideration.

How NEAR AI Responded to the Attack

NEAR AI temporarily suspended its Cloud inference service after detecting unauthorized access.

The company took several steps to contain the incident.

It revoked active sessions and administrative credentials.

It replaced agent tokens and took the deprecated Private Chat system offline.

Engineers then deployed a fix for the SGLang vulnerability across the company's inference servers.

The remaining credentials were rotated.

NEAR AI says it completed a forensic review and restored Cloud inference operations after implementing the fixes.

Incident Response Timeline

The company also reported the vulnerability to the SGLang project.

This step is important because SGLang is open-source software used beyond NEAR AI.

However, the public incident report does not establish that every organization using SGLang was vulnerable or compromised.

The impact on other deployments depends on their software versions, configurations, and security controls.

NEAR AI Cloud Returns After Security Fixes

NEAR AI has confirmed that its Cloud inference service is operational again.

The restoration followed vulnerability remediation and credential replacement.

For customers, this means the company has resumed providing AI inference services.

However, service restoration should not be confused with proof that every possible security risk has been eliminated.

The effectiveness of the fixes depends on the implementation and continued monitoring of the infrastructure.

NEAR AI says it has completed a forensic review.

The company has also committed to expanding security analysis of its inference software and related services.

This includes reviewing code, dependencies, and deployment configurations.

The approach reflects the need to examine the complete AI processing environment rather than relying exclusively on hardware isolation.

Was the NEAR Protocol Blockchain Hacked?

No confirmed evidence indicates that the underlying NEAR Protocol blockchain was compromised in this incident.

NEAR AI has stated that NEAR Protocol and other NEAR services were unaffected.

This distinction is essential.

NEAR AI is part of the broader NEAR ecosystem, but its Cloud inference infrastructure is not the same as the blockchain's consensus system.

The breach involved an AI inference server and related internal services.

It was not reported as an attack on the blockchain's validators, consensus mechanism, or native token infrastructure.

Does the Breach Affect NEAR Token Holders?

The incident does not establish that NEAR token holders lost cryptocurrency.

There is also no confirmed report that attackers obtained blockchain private keys through this breach.

However, security incidents can affect confidence in projects associated with a cryptocurrency ecosystem.

Investors may respond to concerns about operational security even when the underlying blockchain remains functional.

The extent of any market impact would require separate price and trading-volume analysis.

It would be misleading to attribute a particular NEAR price movement to this breach without supporting market evidence.

Why AI Agent Security Is Becoming More Important

AI agents are increasingly used to automate tasks that previously required direct human interaction.

These tasks can include information retrieval, customer support, software development, and financial workflows.

Some agents connect to external applications through APIs.

Others process sensitive documents or maintain persistent conversation histories.

This creates new security challenges.

An attacker compromising an AI agent's environment may gain access to information or credentials used by connected services.

The NEAR AI breach demonstrates how legacy agent deployments can become a security concern.

Legacy Systems Can Increase Risk

Older systems sometimes remain connected to production infrastructure after their original purpose has changed.

They may use outdated authentication mechanisms or lack newer security controls.

In NEAR AI's case, the 18 affected agents were operating outside its confidential computing environment.

That made their data exposure different from the risks associated with the platform's newer protected inference services.

Organizations developing AI infrastructure should therefore review legacy deployments and remove unnecessary access.

The same principle applies to cryptocurrency platforms, where older services and poorly maintained integrations can create attack paths.

How the NEAR AI Incident Compares With Other Crypto Security Breaches

The NEAR AI incident differs from many cryptocurrency security breaches because the confirmed impact involves account information, agent data, and API credentials rather than stolen cryptocurrency.

However, the underlying security lesson is familiar.

Attackers frequently target operational systems surrounding blockchain applications.

For example, Bitnxt previously reported on the Gnosis Pay data breach involving a legacy card-management system.

That incident demonstrated how older infrastructure can create risks for customer information even when core blockchain systems remain unaffected.

Similarly, the Initia Network exploit and subsequent restart highlighted the importance of technical safeguards and effective incident response.

The incidents involved different technologies and consequences.

However, they share a common lesson: security depends on the complete application and infrastructure environment.

AI Security and Blockchain Security Are Converging

As blockchain projects integrate AI services, the boundaries between traditional software security, AI infrastructure, and digital asset protection become increasingly important.

A blockchain may remain secure while an associated application suffers a data breach.

An AI platform may use strong hardware isolation while remaining vulnerable through its inference software.

Security teams must therefore assess each layer independently.

This is particularly important for applications handling financial information or automating transactions.

Bitnxt Take: Confidential AI Needs More Than Hardware-Based Privacy

At Bitnxt, we believe the NEAR AI security breach provides an important lesson for the emerging AI and blockchain industry.

Confidential computing is increasingly presented as a solution for protecting sensitive AI workloads.

The technology offers meaningful benefits by isolating processing environments from certain external threats.

However, the NEAR AI incident demonstrates that hardware isolation cannot compensate for every software vulnerability.

The attacker did not need to defeat the entire NEAR blockchain.

Instead, a vulnerability in the AI inference engine provided access to systems and information that should have remained protected.

That distinction matters.

For users, the security of an AI service depends on more than whether it advertises trusted execution environments.

The service must also maintain secure software dependencies, controlled access, protected logs, and effective credential management.

Our assessment at Bitnxt is that confidential AI platforms should be evaluated on the security of their complete processing systems, not simply on the presence of trusted hardware.

We also believe NEAR AI's public disclosure provides useful technical information.

The company identified the affected software, described the categories of exposed information, and explained the limits of its confidential computing protections.

That level of detail helps users understand what happened.

However, transparency should be followed by continued security improvements.

Why the Incident Matters Beyond NEAR

AI infrastructure is becoming increasingly important to cryptocurrency applications.

Developers are experimenting with autonomous agents, automated trading tools, and AI-powered financial services.

Some of these applications may eventually handle sensitive user information or execute transactions.

A compromised inference system could create risks beyond ordinary data exposure if an agent has access to financial permissions.

The NEAR AI incident does not establish that such financial misuse occurred here.

However, it demonstrates why developers should limit agent permissions and isolate sensitive credentials.

We believe the next stage of AI-blockchain development will require stronger standards for software security, confidential processing, and operational accountability.

What Should Affected NEAR AI Users Do?

NEAR AI says it has contacted users whose account information or agents were confirmed to have been accessed.

Affected customers received instructions from the company's official security address.

Users who received a legitimate notification should follow the relevant steps.

They should also be cautious about unsolicited messages claiming to offer account recovery or compensation.

Protecting Accounts After the Breach

Users should avoid sharing passwords, API keys, or recovery phrases through email or unfamiliar websites.

Developers should review any credentials connected to affected legacy agents.

Where appropriate, they should examine application logs for unusual activity.

NEAR AI has already revoked the two Cloud API keys confirmed to have been exposed.

The company says users who have not been contacted do not need to take action specifically because of this incident.

However, maintaining strong authentication and limiting credential permissions remain sensible general security practices.

Users with questions can contact NEAR AI through its official support and security channels.

What Happens Next for NEAR AI?

Several developments will determine how the company moves forward.

The first is continued monitoring of its restored Cloud infrastructure.

The second is the security review of SGLang and related software dependencies.

The third is the protection of legacy applications and agent deployments.

The fourth is customer communication.

Affected users need clear information about the data involved and any steps required.

The fifth is independent technical scrutiny.

Because NEAR AI uses open-source components, developers and security researchers may be able to review relevant code and configurations.

However, public code availability does not automatically establish that a deployment is secure.

Finally, the company will need to demonstrate that its confidential computing services can maintain user trust after the incident.

Final Thoughts

The NEAR AI security breach highlights an important vulnerability in modern AI infrastructure.

An attacker exploited an SGLang remote code execution flaw to access internal systems, download information belonging to approximately 100 users, and retrieve data from 18 legacy AI agents.

Two customers' API keys were exposed and subsequently revoked.

The attacker may also have observed requests being processed on November 8, including confidential-mode requests.

NEAR AI says it found no indication that stored Private Chat conversations or uploaded files were accessed.

The company has patched the vulnerability, rotated credentials, completed a forensic review, and restored Cloud inference services.

The underlying NEAR Protocol blockchain was not affected.

Bitnxt believes the incident demonstrates that confidential AI security must extend beyond hardware isolation to include application code, inference engines, credentials, and legacy infrastructure.

As AI and blockchain technologies become more closely connected, protecting the entire system will be essential for maintaining user confidence.