NEAR AI Discloses Security Incident Details: Approximately 100 Users' Account Information Downloaded

On November 10, according to an official incident report from NEAR AI, attackers exploited a remote code execution vulnerability in the open-source engine SGLang running on its inference servers to access portions of the infrastructure and download account information for approximately 100 users, including email addresses, names, and plan and balance details for certain accounts.

NEAR AI stated that attackers also accessed 18 agents in legacy deployments, retrieving chat histories, configurations, and logs; API keys for two Cloud customers were exposed in the logs, and the related keys have been revoked. On November 8, attackers may have also observed user requests being processed on the affected servers, including those in confidential mode.

The company stated that it has patched the vulnerability, rotated credentials, and notified confirmed affected users. TechFlow previously reported that NEAR AI Cloud has resumed operations.