LIVE FEED
CRITICAL SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents // FIRST LOOK F-Secure Releases AI Harms Taxonomy Mapping 26 Consumer Risks // CRITICAL Cursor Marketplace Trojanized via Stolen Fireworks AI Key // CRITICAL Cairn AI Framework Hits Semiconductor and Defense Orgs // HIGH TypoPrompting: 186 Fake AI Domains Spread ClickFix Malware // CRITICAL Post-Training Supply Chain Attacks Backdoor AI Coding Agents // HIGH Google Project Zero Cuts Disclosure Window as LLMs Speed Up Exploits // HIGH Unsanctioned AI Agents Expose Five Enterprise Identity Security Gaps // HIGH OpenAI Agents Gain Root Access, Conceal Activity in CI Clusters // FIRST LOOK AWS Launches A2A Protocol for Interoperable Multi-Agent Systems //
ATLAS OWASP CRITICAL Active exploitation · Immediate action required LLM Security Agentic AI Supply Chain Industry News RELEVANCE ▲ 9.2

SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents

SOURCE The Hacker News ↗
TL;DR CRITICAL
  • What happened: RCE flaw in SGLang inference engine let attacker breach NEAR AI's TEE-protected servers and steal agent and user data.
  • Who's at risk: Any organisation deploying SGLang as an inference backend — especially those relying on TEEs for confidentiality guarantees — is directly exposed.
  • Act now: Audit all SGLang deployments and apply NEAR AI's patch or restrict external access immediately · Rotate all AI agent tokens, cloud API keys, and credentials stored in logs or configuration files · Do not treat TEE isolation as a substitute for secure software running inside the environment
SGLang RCE Exploit Breaches NEAR AI, Hits 18 Agents

Overview

On or around 3 November 2026, an unknown attacker exploited a remote code execution (RCE) vulnerability in SGLang — a widely used open-source inference engine for large language models — to execute arbitrary code on inference servers operated by NEAR AI. The breach is notable for two reasons: it compromised infrastructure running inside a Trusted Execution Environment (TEE), and it exposed data from AI agents operating on a separate, non-TEE deployment. The incident affects approximately 100 users and 18 AI agents, and raises fundamental questions about security assumptions in confidential-compute AI deployments.

Technical Analysis

SGLang runs inside NEAR AI’s TEE, which is intended to prevent even company insiders from reading inference traffic. However, as NEAR AI confirmed in its incident report, a TEE does not protect against vulnerabilities in the software running within it. The attacker leveraged the SGLang RCE flaw to execute code inside the TEE boundary, gaining visibility into live inference requests — including those submitted in NEAR AI’s “confidential mode.”

From the initial foothold, the attacker pivoted laterally to an internal system backing “Private Chat,” a deprecated NEAR AI product. This secondary access yielded account details for approximately 100 users: email addresses, names, and for some accounts, plan and balance information. No stored conversations or uploaded files appear to have been accessed.

The attacker also reached an older NEAR AI Agents deployment that did not operate within a TEE. From 18 agents on that system, the attacker exfiltrated chat histories, configuration settings, logs, and two customer NEAR AI Cloud API keys embedded in those logs.

No CVE identifier has been assigned to the SGLang flaw, and affected version ranges have not been disclosed publicly.

Framework Mapping

  • AML.T0040 (AI Model Inference API Access): The attacker accessed live inference requests passing through the compromised server.
  • AML.T0057 (LLM Data Leakage): Confidential inference requests and agent chat histories were exposed.
  • AML.T0083 / AML.T0084 (Credentials from / Discover AI Agent Configuration): API keys and agent configuration data were exfiltrated from logs.
  • AML.T0010 (AI Supply Chain Compromise): The root cause is a vulnerability in an open-source inference engine dependency.
  • LLM05 (Supply Chain Vulnerabilities): SGLang is a third-party dependency; its vulnerability cascaded directly into the host platform.
  • LLM06 (Sensitive Information Disclosure): User PII, API keys, and agent operational data were disclosed.

Impact Assessment

The breach demonstrates that TEE-based confidentiality is bounded by the security of the software stack inside the enclave. Organisations that have positioned TEEs as a primary control for processing sensitive AI workloads should treat this as a direct challenge to that architecture. The exposure of Brave Leo assistant traffic — which routes through NEAR AI’s TEE infrastructure — has not been confirmed or ruled out, expanding the potential blast radius beyond NEAR AI’s direct customers.

Mitigation & Recommendations

  1. Patch SGLang immediately. Apply NEAR AI’s disclosed fix across all inference server deployments. Monitor the SGLang project for an official upstream patch and CVE assignment.
  2. Rotate all credentials. Any API keys, agent tokens, or administrative credentials that may have passed through affected infrastructure should be considered compromised and rotated.
  3. Audit TEE assumptions. Treat TEEs as one layer of a defence-in-depth stack, not a standalone confidentiality guarantee. Conduct code-level security reviews of all software running inside enclaves.
  4. Restrict inference API exposure. Limit network access to SGLang endpoints; apply allowlisting where possible.
  5. Review agent log hygiene. Ensure API keys and secrets are never written to agent logs or configuration files in plaintext.

References

◉ AI THREAT BRIEFING

Stay ahead of the threat.

Twice-weekly digest of critical AI security developments — every story mapped to MITRE ATLAS and OWASP LLM Top 10. Free.

No spam. Unsubscribe anytime.