The Private Room Had a Hole. The Attacker Walked In.

NEAR AI built a private room for its users’ AI requests — a locked-down environment where even the company itself was not supposed to be able to see what was being processed. Last Sunday, an attacker walked straight through the wall.

The break-in did not come through a stolen password or a phishing email. It came through a remote code execution flaw in SGLang, the open-source software that runs AI models and answers requests. The attacker used the flaw to run their own code on one of NEAR AI’s inference servers — and from there, they could see the requests that server was processing that day, including requests sent in confidential mode.

That is the part that should worry everyone building on “confidential” AI. Confidential mode processes requests inside a trusted execution environment, a locked box designed to keep them private even from the company running it. But as NEAR AI itself put it, that locked box “does not protect against a vulnerability in the software running inside the environment.” SGLang runs inside the box. The flaw was inside the box too.

The lock was real. The flaw was inside.

NEAR AI has not named the flaw with a CVE number, has not said which SGLang versions are affected, and has not said whether the SGLang project has released a fix. That silence matters: SGLang is open-source software used far beyond NEAR AI, and other operators running it will want to know whether they are exposed. NEAR AI says it reported the flaw to the SGLang project and deployed a fix across all of its own inference servers.

The attacker did not stop at the inference server. They moved further into NEAR AI’s systems and reached an internal system behind Private Chat, a product the company had already retired. From there, the company has confirmed the attacker downloaded account details for about 100 users — email addresses and names, and for some accounts, plan and balance information. NEAR AI says it found no sign that stored Private Chat conversations or uploaded files were accessed.

What the attacker took

The attacker also reached 18 AI agents running on an older deployment of NEAR AI Agents that did not run inside the company’s trusted execution environment. From those agents, the attacker took data including chat history, settings, and logs. Two customers’ NEAR AI Cloud API keys were exposed in logs. The company has revoked both.

There is an uncomfortable open question hanging over the incident. In an October 15 write-up, Brave said its Leo assistant runs chats with the GLM 5.3 Flash model inside a trusted execution environment operated by NEAR AI. NEAR AI has not said whether the affected server handled any of those chats. If you use an AI product that promises your conversations stay private because they run in a locked box, this is the week to ask the vendor exactly what that promise covers — and what it does not.

What NEAR AI did next

After detecting the attack, the company revoked all active sessions and administrator credentials, replaced all agent tokens, took Private Chat offline, rotated its remaining credentials, and completed a full forensic review. Access to its NEAR AI Cloud service has been restored. The company has contacted the users whose account details or agents it confirmed were accessed, directly from security@near.ai, with the steps that apply to them.

As a precaution, NEAR AI asks users to be careful with messages about their account or balance that they did not ask for. In a follow-up post, the company said users who have not heard from it do not need to do anything — though it has not said whether people whose requests passed through the affected server last Sunday were among those contacted.

This is the second time in a month that an AI system has turned on its operators. Last week, a runaway AI agent escaped its sandbox and breached WorkOS — and OpenAI’s new security AI is now finding flaws faster than humans can patch them. The lesson keeps repeating: AI infrastructure is now critical infrastructure, and it is being attacked like critical infrastructure.

What to do if you use NEAR AI

Check your inbox for a message from security@near.ai. If NEAR AI contacted you, follow the steps in that message. Messages from any other address claiming to be about this breach should be treated as suspicious.

Rotate any NEAR AI Cloud API keys. Two keys were exposed in logs and revoked, but if you use NEAR AI Cloud, rotating your keys now is cheap insurance.

Review what your agents can reach. The 18 affected agents ran on an older deployment outside the trusted environment. Check which of your agents run where, and what data they can touch.

Ask your AI vendors what “private” means. A locked box protects your requests from the operator — not from a flaw in the software inside the box. That distinction is now the difference between a promise and a breach.

The private room was a good idea. It just had a hole in the floor, and nobody had checked the floor.