Third-Party Cyber Attack on NEAR AI Exposes Data From 100 Users and 18 Agents
An attacker exploited a remote code execution flaw in SGLang to breach NEAR AI, accessing data from 18 AI agents and roughly 100 user accounts. The incident shows how weaknesses in fast‑moving AI tooling can spill over into the companies that build on top of it, with confidential prompts and outputs potentially exposed.
A security breach at NEAR AI is putting a spotlight on how vulnerabilities in the AI software stack can cascade into data exposure for end users, even when the flaw lies in a third‑party component rather than the platform itself.
According to NEAR AI’s own account, an attacker used a remote code execution (RCE) vulnerability in SGLang to gain unauthorized access to one of its servers. By exploiting the flaw, the intruder was able to see data from 18 AI agents running on the system and information tied to about 100 user accounts. The company says confidential AI requests processed on that server may also have been visible to the attacker during the intrusion.
SGLang is a tool used to manage and serve large language models. A critical RCE bug in such infrastructure gives an attacker the ability to run arbitrary code on the host machine, which in practice can mean reading memory, exfiltrating files, or pivoting deeper into a corporate network. In this case, the exploit was reportedly limited to a specific server, but the incident shows how much trust AI startups place in the security of upstream tools.
For NEAR AI’s customers, the risk is not stolen passwords alone. Many organizations experimenting with AI send sensitive text through these systems: product plans, internal emails, legal drafts, or proprietary code. If an attacker can see both prompts and outputs, they may gain insight into business strategy or technical designs without ever breaching the customer’s own systems.
Operationally, the breach forces NEAR AI — and peers across the sector — to rethink how they segment workloads and protect logs. Running multiple agents and users on one machine concentrates risk. When that node falls, so do all the conversations and configurations it holds. Fine‑grained isolation, stricter patching regimes, and aggressive monitoring of admin‑level tools move from best practice to survival requirements once an RCE exploit is being used in the wild.
The episode also exposes a broader systemic issue: the AI boom has driven rapid adoption of new frameworks and orchestration layers that haven’t seen the same hardening as mature web or operating system stacks. Every additional component between a user and a model — schedulers, routers, vector databases — becomes a potential attack surface. A single overlooked authentication check or unsafe default in one layer can undo careful security decisions elsewhere.
From a strategic standpoint, this kind of breach matters because AI systems are increasingly woven into critical workflows. Governments, banks, and health providers are all testing AI for analysis and automation. If attackers learn that compromising an AI service yields rich, unencrypted streams of sensitive data, those platforms become high‑value intelligence targets, not just curiosities.
The memorable lesson here is simple: in AI, the conversation is the payload. Protecting infrastructure without protecting the text running through it leaves both companies and users exposed.
Indicators to watch now include whether NEAR AI publishes a detailed post‑mortem with technical indicators of compromise, how quickly SGLang patches are deployed across other providers, and whether regulators start asking AI companies to treat prompts and outputs as regulated data when it comes to breach notification rules. Any sign that similar exploits are being used against other AI platforms would suggest this incident is part of a wider campaign rather than a one‑off intrusion.
Sources
- OSINT