SGLang RCE flaw used to breach NEAR AI and steal user data

What happened

Last Sunday, an attacker exploited a remote code execution vulnerability in the SGLang inference engine to gain access to a NEAR AI server. While the server utilized a Trusted Execution Environment (TEE) designed to keep requests private, SGLang runs inside that environment, allowing the attacker to observe processed requests.

The attacker moved laterally into an internal system associated with the deprecated Private Chat product, downloading names, email addresses, and plan or balance information for about 100 users. The attacker accessed 18 AI agents on an older deployment that did not utilize a TEE, extracting chat history, settings, and logs. Two customer NEAR AI Cloud API keys were also exposed in logs; NEAR AI has since revoked them.

Why it matters

This incident demonstrates that hardware-backed isolation like TEEs cannot protect against vulnerabilities in the software running inside the secure enclave. Because the SGLang engine itself was compromised, the "confidential" mode was effectively bypassed. This highlights a critical blind spot in AI infrastructure: if the inference engine is vulnerable, the privacy of the entire execution environment is lost.

Who is affected

• SGLang (inference engine)
• NEAR AI Agents (older deployments not using TEE)
• NEAR AI Cloud (API keys exposed in logs)
• NEAR AI Private Chat (deprecated product)

What to do now

1. Update SGLang to the fixed version on all inference servers.
2. Rotate all remaining credentials and agent tokens.
3. Monitor accounts for unsolicited messages regarding account or balance changes.
4. Review logs for unauthorized access to internal systems or agent configurations.

What we don't know yet

• The specific CVE ID associated with the SGLang RCE flaw.
• The specific versions of SGLang that are vulnerable.
• Whether the SGLang project has released a public fix.
• Whether Brave's Leo assistant chats were handled by the affected server.