Near AI has sold confidential computing as a way to keep AI prompts encrypted and isolated from the company running the servers. A November 9 company report, covered by Decrypt on November 11, 2026, describes a breach in which a software flaw let an attacker reach account records and older agent data anyway.
Near AI said the attacker used a remote code execution vulnerability in SGLang, an open-source engine that runs AI models and generates responses to user requests. The exploit allowed commands to be executed on one inference server and then used to reach other parts of Near AI’s infrastructure. Investigators traced the intrusion to an internal system connected to Private Chat, a feature the company had already retired.
The confirmed exposure was limited to what Near AI said it could verify. The attacker downloaded names and email addresses for approximately 100 users, along with subscription plan and account balance information for some of them. On an older deployment of Near AI Agents, another 18 agents were accessed. From those agents the attacker retrieved chat histories, settings, and logs. Near AI said those agents were not running inside its confidential computing environment, which is designed to shield information from the operator of the servers.
Logs also exposed NEAR AI Cloud API keys belonging to two customers. Near AI describes the keys as credentials that applications use to access cloud services. It said both were revoked, and it did not say whether the attacker used them.
Near AI found no indication that stored Private Chat conversations or uploaded files had been accessed. On its account, the confirmed theft involved account records and legacy agent data. The investigation still treats exposure of live confidential requests as a possibility.
That gap sits inside a larger Near ecosystem pitch that has paired AI privacy with blockchain ambitions. Near AI’s Cloud product uses trusted execution environments, or TEEs, so prompts can stay encrypted and isolated from server operators while models process them. Hardware isolation does not make the software inside that environment safe. Near AI acknowledged the limit: “It does not protect against a vulnerability in the software running inside the environment.” It said the SGLang flaw let the attacker run code where confidential requests were being processed.
In October, Near AI announced that Brave’s Leo browser assistant was using its confidential inference infrastructure for a supported AI model. The incident report does not identify Brave users among those affected.
SGLang had already drawn security research. In July, Carnegie Mellon University’s CERT Coordination Center documented six vulnerabilities in the project, including bugs that could let attackers execute commands or expose credentials, depending on how servers were configured. Near AI did not identify the specific SGLang flaw exploited in this incident, so the report gives no basis for linking the breach to those earlier disclosures. Near AI said it reported the vulnerability to SGLang’s developers.
The company said that on detection it revoked all active sessions and administrative credentials, replaced all agent tokens, took Private Chat offline, and deployed a fix for the SGLang vulnerability across all inference servers. It said it has completed rotation of all remaining credentials and a full forensic review, notified users whose account details or agents it confirmed were accessed, and will make any regulatory notifications that are required. It contacted the owners of all 18 affected agents individually and warned users to be wary of unsolicited messages referring to their Near AI accounts or balances.
On Near AI’s own accounting, the incident is not a confirmed breach of every privacy control it describes. It is a documented case in which a flaw in software running inside the protected environment was enough to move an attacker through inference infrastructure and out with names, emails, some account details, and logs from agents left on an older deployment.
Original article: Near AI Breach Exposes User Details and Data From 18 AI Agents (Decrypt, November 11, 2026).
