SGLang RCE Flaw Breached NEAR AI, Exposing Data From 18 Agents and ~100 Users

NEAR AI has disclosed a security incident in which an attacker exploited a remote code execution (RCE) vulnerability in SGLang, an open-source inference engine, to run code on one of its inference servers. The breach, which occurred last Sunday, may have exposed requests processed on that server that day — including traffic sent in the platform's confidential mode, which is designed to keep workloads inside a trusted execution environment (TEE).

According to reporting by The Hacker News, the company stated earlier this week that the attacker could have viewed requests being handled on the affected server. NEAR AI has since indicated that data tied to 18 agents and roughly 100 users was stolen.

What Happened

The intrusion centered on SGLang, a widely used open-source framework for serving large language models. An RCE flaw in the engine allowed the attacker to execute arbitrary code on NEAR AI's infrastructure. Once code execution is achieved on an inference server, the attacker sits in a position to inspect traffic passing through it — an especially sensitive prospect for an AI platform, where requests often contain prompts, model outputs, and potentially confidential user data.

The most troubling aspect of the disclosure is the apparent impact on confidential mode. NEAR AI markets that mode as processing requests inside a TEE, a hardware-backed isolation mechanism intended to prevent even the infrastructure operator from accessing workload contents. The company's admission that requests sent in confidential mode that day could have been seen suggests the protection did not hold in this instance — although the precise mechanism by which the attacker obtained visibility into those requests has not been publicly detailed.

Why Confidential Computing Claims Deserve Scrutiny

This incident lands at an awkward moment for the AI infrastructure sector, where "confidential AI" has become a significant selling point. TEEs — typically implemented via technologies such as Intel SGX or TDX, AMD SEV, or Arm Confidential Compute Architecture — are promoted as a way to reassure customers that their prompts and data remain private even when processed by a third party.

However, TEEs protect data inside the enclave. They do not automatically protect against vulnerabilities in the software stack running within that enclave, nor against weaknesses in how requests are routed, logged, or handled before and after enclave processing. An RCE in the inference engine itself can undermine the security model if the attacker can influence code paths, inspect memory, or intercept data at points where it is not enclave-protected.

For organizations relying on confidential AI services, the incident is a reminder to ask pointed questions: Where exactly does the TEE boundary begin and end? What is the attestation model? And what happens to requests before they enter and after they leave the protected environment?

The Broader SGLang Attack Surface

SGLang has become a popular choice for high-throughput LLM serving, which makes vulnerabilities in it disproportionately impactful. Inference servers frequently sit at the edge of an organization's AI stack, accepting requests from agents, applications, and end users. A flaw that permits remote code execution in such a component is effectively a foothold into the environment hosting the models.

This is not the first time SGLang has drawn security attention. The project has previously been the subject of vulnerability research and patches, and its rapid development pace — like many fast-moving open-source AI projects — raises questions about the maturity of its security posture relative to its adoption. Teams deploying inference engines at scale should treat them as internet-facing production software, not experimental tooling.

Recommendations for AI Infrastructure Operators

Organizations running SGLang or comparable inference frameworks should consider the following steps:

  • Patch promptly. Track advisories for SGLang and apply updates as soon as fixes for known RCE issues are available. Confirm which version of the engine is running across every deployment.
  • Reduce exposure. Inference endpoints should not be reachable from the public internet unless strictly necessary. Place them behind authentication, rate limiting, and network segmentation.
  • Assume compromise is possible. Log and monitor requests at the gateway layer, and retain enough telemetry to reconstruct what an attacker on an inference host might have seen.
  • Re-examine confidential computing claims. Validate TEE implementations with independent attestation and understand which components sit outside the protected boundary.
  • Rotate secrets. Any credentials, API keys, or tokens processed by affected infrastructure should be treated as potentially exposed.

The Takeaway

The NEAR AI breach illustrates a recurring theme in AI security: the rapid adoption of inference infrastructure has outpaced the hardening of that infrastructure. An RCE in an open-source serving engine became a data exposure event affecting real users and agents — and, notably, one that touched a confidential processing mode customers likely trusted.

For defenders, the lesson is that AI platforms inherit the security properties of every component in their stack. Confidential computing is not a substitute for secure software development, prompt patching, and disciplined network exposure management.

Original source: The Hacker News — SGLang RCE Exploit Breaches NEAR AI