NEAR AI, the artificial intelligence arm of NEAR Protocol, has disclosed a breach of its infrastructure after an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine. About 100 users and 18 legacy agents were affected. According to the company, the NEAR Protocol blockchain was not impacted. The episode highlights the risks of insecure deserialization in AI infrastructure.
🔑 Key takeaways
- Entry point: remote code execution on a single SGLang inference server on November 8, 2026
- Data exposed: email addresses and names, plus subscription and account balance details for some users
- Legacy agents: 18 agents affected, including conversation histories, configurations and logs; 2 API keys exposed and later revoked
- Blockchain: NEAR Protocol unaffected according to NEAR AI, with no reported impact on funds
An intrusion that started on a single inference server
According to the incident report published on November 9, 2026, the attacker first gained code execution on a single inference server on November 8. That server ran SGLang, a framework developed by LMSYS to serve large language models (LLMs). From that foothold, the attacker reached an internal system linked to Private Chat, a NEAR AI feature that had been previously deprecated.
Public sources remain vague on the timeline. The report does not specify when the intrusion was detected, how long it lasted, or how many attempts were made. BloomingBit reports that the intrusion was blocked after detection, while the same report acknowledges unauthorized access to part of NEAR AI’s infrastructure.
- Initial access: remote code execution on an SGLang inference server
- Pivot: an internal system tied to Private Chat, a deprecated service that remained reachable
- Confirmed exposure: user requests being processed on the compromised server
Exposed data: accounts, agents and API keys
From the system linked to Private Chat, the attacker downloaded account information for about 100 users. The exposed fields included email addresses and names. For some of them, the records also contained subscription details and the account balance. NEAR AI has not disclosed the exact number of users in each category or the amounts involved.
The intrusion also reached 18 agents running on a legacy NEAR AI Agents deployment. That deployment did not run inside the company’s confidential computing environment. The retrieved data included conversation histories, configuration parameters and operational logs. Logs from two NEAR AI Cloud customers exposed their API keys, which the company says it has revoked.
| Category | Reported scale | Data type |
|---|---|---|
| Private Chat accounts | About 100 users | Email, name, sometimes plan and balance |
| Legacy agents | 18 agents | Conversations, configurations, logs |
| API keys | 2 NEAR AI Cloud customers | Keys revoked, per NEAR AI |
The report indicates the attacker could have observed user requests being processed on the compromised server, including requests handled in confidential mode. It does not state how many requests may have been observed, nor confirm that any observation actually took place. NEAR AI says it found no evidence that stored Private Chat conversations or uploaded files were accessed. In its own words:
“Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment, and that is what happened here.”
NEAR AI, incident report
That distinction matters: the inference software, not the hardware enclave, was the attack surface.
Three critical CVEs assigned to SGLang
Orca Security, which coordinated its research with CERT/CC (case VU#665416, with additional analysis from CERT/CC researcher Christopher Cullen), disclosed three vulnerabilities, all classified as CWE-502 (insecure deserialization). Orca does not explicitly tie NEAR AI’s incident to any of these identifiers.
| Identifier | Component | CVSS 3.1 | Vector |
|---|---|---|---|
| CVE-2026-3059 | ZeroMQ broker for multimodal generation | 9.8 | Unauthenticated RCE |
| CVE-2026-3060 | Dispatch encoder receiver | 9.8 | Unauthenticated RCE if module exposed |
| CVE-2026-3989 | replay_request_dump.py script | 7.8 | Local, malicious pickle loaded manually |
The first two vulnerabilities share the same mechanism. By default, the ZeroMQ broker binds to all available interfaces, with no authentication or source address filtering, and immediately deserializes incoming data with pickle.loads(). An attacker with network access to the port can execute code within the SGLang process, without credentials or user interaction. According to Orca, default text deployments of SGLang do not expose this broker. For CVE-2026-3060, the source material does not reliably specify the affected versions.
Orca notes that the project contained more than twenty calls to pickle.loads(). The same pattern had already been behind CVE-2024-9053 in vLLM and CVE-2025-10164 in another SGLang component. At the time of publication, maintainers had not responded to coordinated disclosure and no official patch was available.
NEAR AI’s report, by contrast, states that the flaw was fixed across its inference servers and reported to SGLang’s maintainers. The sources do not establish whether this flaw was one of the three vulnerabilities published by Orca, nor reconcile the absence of an official patch with the fix NEAR AI deployed.
NEAR AI’s response and implications for NEAR Protocol
NEAR AI describes a multi-step response:
- Closure of the access used by the attacker and replacement of the affected credentials
- Deployment of the SGLang fix across all inference servers
- Revocation of active sessions and administrative credentials, and renewal of agent tokens
- Taking Private Chat offline, a full forensic review and rotation of remaining secrets
Access to NEAR AI Cloud, suspended during the investigation, has since been restored. The company contacted users and agent owners individually, advising them to be wary of unsolicited messages referencing their account information or balances. Required regulatory notifications were said to be forthcoming. The code, dependencies and deployment configurations of the confidential inference stack remain public.
NEAR AI maintains that NEAR Protocol and other ecosystem services were not affected, and no consequences for the blockchain or user funds have been reported. The Block’s page showed NEAR up 3.06% at the time of viewing, but the source does not attribute that move to the incident and provides no volume or market reaction data. In October 2026, NEAR AI had surpassed one million staked NEAR through a service that funds AI inference with staking rewards.
Outlook and scenarios
The case is a reminder that a confidential computing environment offers limited protection if the software it runs contains a flaw. Three scenarios remain open. The first is that the impact stays confined to the 100 users and 18 agents identified, provided logs and keys were fully contained. The second assumes additional data surfaces during the independent review or regulatory notifications. The third involves secondary exploitation of credentials if secret rotation proved incomplete.
For the wider ecosystem, two points deserve attention: coordinated disclosure of flaws in open-source inference frameworks, and NEAR AI’s commitment to treat the inference software with the same rigour as the enclave itself. Upcoming updates from the company and SGLang’s maintainers should clarify the timeline and the exact status of the fixes.
Sources
- The Block, November 10, 2026
- Orca Security, SGLang vulnerability analysis
- NPR, October 24, 2026
- BloomingBit
- Crypto.news
- Kaspersky, blog
Cet article est publié à titre informatif et éducatif. Il ne constitue en aucun cas un conseil en investissement. Faites vos propres recherches (DYOR) avant toute décision.
