SGLang flaw used to breach NEAR AI server, 18 agents hit

An attacker exploited a remote code execution flaw in SGLang, an open-source engine for running large language models, and ran code on one of NEAR AI's inference servers on Sunday 8 November 2026, according to The Hacker News. NEAR AI disclosed the breach earlier this week, after the intrusion was discovered on 10 November 2026. Data was taken from 18 AI agents and about 100 users.

The company said the attacker could also have seen requests being processed on that server that day. That includes requests sent in what NEAR AI calls confidential mode, which processes requests inside a trusted execution environment, a hardware-isolated part of a processor meant to keep data hidden even from the operator of the machine. The confidential mode guarantee is the part of the disclosure most likely to concern users, because it is the feature customers rely on when they do not want the inference provider itself to see their prompts.

The entry point was not NEAR AI's own code. SGLang is third-party open-source software that sits in the serving path for model requests, which makes this a supply chain failure: a flaw in a widely shared component became a flaw in everyone who deployed it. Operators running the same engine should assume the issue applies to them until they have checked their own versions.

For agent operators, the practical exposure is wider than a single server. An inference server sees the full content of whatever an agent sends it. That can include system prompts, tool definitions, retrieved documents, user messages and any credentials that happen to be pasted into a conversation. Anything processed on the affected server on 8 November 2026 should be treated as potentially seen by the attacker, including secrets that agents hold on behalf of their users.

The number of affected parties is small in absolute terms: 18 agents and around 100 users. But agent platforms concentrate risk. A single compromised inference host can touch every agent routed through it, regardless of who built those agents or how carefully they were written. Hardening an agent's own prompt handling does nothing if the machine running the model is compromised.

The available reporting does not say how the attacker found the server, how long they had access before detection, what specific data was taken, or whether a patched version of SGLang was available at the time. NEAR AI's statement, as reported, confirms the intrusion and the scope of exposure. The company has not, in the reporting seen, described remediation steps or a timeline for a fuller account. The status of the incident is confirmed.