NEAR AI Discloses Security Incident Details: Account Information of About 100 Users Was Downloaded

NEAR AI disclosed that attackers exploited a remote code execution vulnerability in SGLang, the open-source engine powering its inference servers, to access parts of its infrastructure and download account information for roughly 100 users, including email addresses, names, and plan and balance details for some accounts. The attackers also reached 18 agents in a legacy deployment, obtaining chat histories, settings, and logs, while API keys for two Cloud customers were exposed in logs and have since been revoked. On November 8, the attacker may also have observed user requests being processed by affected servers, including requests made in confidential mode. NEAR AI said it has patched the flaw, rotated credentials, and notified confirmed affected users, and its NEAR AI Cloud service is back online. The incident highlights the supply-chain risk that open-source inference engines pose to AI cloud providers, and the next things to watch are whether more affected users come forward and how NEAR AI hardens its logging and key management.