Near AI Breach Exposes User Details and Data From 18 AI Agents

In brief

• NEAR AI says an attacker exploited a flaw in SGLang, accessed internal systems, and downloaded account details for approximately 100 users.
• Data from 18 older AI agents included chat histories and logs; API keys for two Cloud customers were also exposed and revoked.
• Confidential-mode requests processed on November 8 may have been visible, although NEAR AI found no indication that stored Private Chat conversations were accessed.

Near AI has disclosed a breach that exposed account information belonging to about 100 users and data from 18 AI agents after an attacker exploited software running its servers.

The company said in a November 9 report that an attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models and generates responses to user requests.

The exploit allowed the intruder to execute commands on one inference server and then reach other parts of Near AI’s infrastructure.

Investigators traced the intrusion to an internal system connected to Private Chat, a feature the company had already retired. The attacker downloaded names and email addresses for approximately 100 users, along with subscription plan and account balance information for some of them.