NEAR AI breached through an SGLang code-execution flaw; even confidential-mode requests may have been seen

NEAR AI, which runs AI models for customers and for Brave's Leo assistant, says an attacker used a remote code execution flaw in SGLang, the open-source engine that serves its models, to take over one inference server on November 8, 2026 and move into other internal systems. About 100 users' account details, data from 18 legacy agents and two customers' API keys were taken. NEAR AI says it has patched and rotated credentials; teams that run SGLang themselves should treat this as a reminder to keep inference servers off untrusted networks, because the flaw has not been publicly identified.

What happened, in plain English

SGLang is a "serving framework": the software that loads a large language model (LLM) onto GPU servers and answers requests from apps, much like a web server answers requests for pages. Many AI companies and in-house teams use it.

According to NEAR AI's incident report, dated November 9, 2026, an attacker exploited a remote code execution (RCE) vulnerability in SGLang. RCE means the attacker could make the server run their own commands. From that one inference server, they reached NEAR AI's wider infrastructure, including an internal system behind Private Chat, a product the company had already deprecated.

What makes this case unusual is NEAR AI's "confidential" mode. It runs models inside a trusted execution environment (TEE): a hardware-sealed area of the server that even the cloud operator cannot look into. NEAR AI says that on November 8 the attacker could have observed requests being processed on the compromised server, including confidential-mode requests. The company's explanation: confidential computing protects against the operator and the host, not against a bug in the software running inside the enclave.

An analogy: a TEE is a bank vault with glass walls nobody outside can see through. But if the clerk working inside the vault can be tricked into following a stranger's instructions, the vault does not help.

NEAR AI has not said which SGLang flaw was used, which version it ran, or whether a CVE (Common Vulnerabilities and Exposures) identifier exists. It says it reported the bug to the SGLang project.

Are you affected? What to do now

If you are a NEAR AI customer or user:

• Check your inbox for a message from security@near.ai. NEAR AI says it contacted the roughly 100 users whose account details (email, name and, for some, plan and balance information) were downloaded, and each of the 18 agent owners whose chat history, settings and logs were taken. In a follow-up post, the company said users who were not contacted do not need to do anything.
• Watch for phishing. NEAR AI advises caution with unsolicited messages that mention your account or balance. Stolen names, emails and balances are exactly what a convincing scam email needs.
• NEAR AI Cloud API users: two customers' keys showed up in logs and have been revoked. If your key stopped working, generate a new one.
• If you sent confidential-mode requests on November 8, 2026, assume their contents may have been visible to the attacker. NEAR AI has not said whether it notified everyone whose requests passed through that server.

Brave Leo users: Brave wrote on October 15, 2026 that Leo's GLM 5.3 Flash chats run inside a NEAR AI-operated hardware enclave. Neither company has said whether the compromised server handled Leo traffic. There is no user action published for Leo; this is not confirmed either way.

If your team runs SGLang itself:

Because the specific flaw is not public, there is no version number to check against yet. Practical steps:

• Keep SGLang off the internet and off flat networks. Put the model server behind an authenticating gateway or reverse proxy, and restrict its ports with a firewall so only your application tier can reach it.
• Turn off debug features in production. A separate, already-public SGLang flaw, CVE-2026-111391, lets anyone who reaches the optional "dumper" debug server run code. Make sure the DUMPER_SERVER_PORT environment variable is not set. When we checked on November 11, 2026, the GitHub issue was still open with no maintainer reply. We have no evidence that this is the bug used against NEAR AI.
• Limit what an inference server can reach. It should not hold admin credentials, database passwords or keys to other systems. NEAR AI's attacker got from one model server to internal systems.
• Keep logs clean of secrets. Two of NEAR AI's customers' API keys were exposed through logs.
• Watch for a fix. Follow SGLang's releases and security page. As of November 11, 2026, the project had no published security advisories; the latest release on PyPI is 0.5.23 (October 30, 2026).

If you only use hosted AI APIs from other providers and do not run SGLang, there is nothing to do.

The expert view

Root cause, as far as we know. NEAR AI describes the entry point only as an SGLang RCE. That leaves the important technical question open: was this a new bug, a known one, or an exposed internal interface? SGLang, like other high-throughput inference engines, runs several cooperating processes that talk over internal channels and exposes optional management and debug endpoints. Those channels have repeatedly been designed for trusted private clusters. Our earlier reporting on the SGLang dumper eval flaw and the Mooncake KV cache layer followed the same pattern.

The attack chain, conceptually. Code execution on a model server gave the attacker three things: the live request stream on that host, whatever credentials the host could use, and a network position inside the provider. The report shows all three were used: requests were observable, logs contained customer keys, and the attacker reached a deprecated internal system with account data and an older agent deployment that ran outside the enclave.

Why confidential computing did not stop it. TEEs shift trust from the host operator to the code inside the enclave and its attestation. Attestation proves which software is running; it does not prove that software is free of bugs. An RCE in the serving engine runs with the enclave's own view of plaintext prompts and outputs. This is a known limit of the model, and NEAR AI states it plainly. The lesson for buyers of "private" or "confidential" AI: ask how the provider secures, patches and isolates the inference software, not only whether it uses enclave hardware.

Why the blast radius grew. Two classic issues widened the incident beyond one server: a deprecated product (Private Chat) still connected to live infrastructure, and a legacy agent deployment outside the protected environment. Neither is AI-specific. Both are common in fast-moving AI startups that ship and retire products quickly.

Severity in context. There is no CVE and no CVSS score. Numerically the incident is small, about 100 users, 18 agents and two keys. Its significance is that it is a confirmed, real-world compromise of an AI inference provider through the serving engine itself, and that it touched traffic marketed as confidential.

What is still unknown. The specific SGLang flaw and affected versions; whether SGLang has fixed it upstream; how the attacker first reached the server; the exact time window; whether Brave Leo traffic passed through the affected server; and whether all users whose requests were exposed will be notified. No one has attributed the attack to a specific actor.

Official sources

• NEAR AI: Security incident report: SGLang vulnerability (November 9, 2026)
• Brave: Bringing end-to-end encryption to browser AI (October 15, 2026)
• SGLang: GitHub security page and releases
• SGLang: Issue #44188, dumper filter eval() RCE; CVE record CVE-2026-111391
• PyPI: sglang release history
• Coverage: The Hacker News, The Block