NEAR AI disclosed a breach on November 9. An attacker exploited a remote code execution flaw in SGLang. SGLang is the open-source inference engine running on its servers. The attacker ran code on one inference server on November 8. That server processes confidential-mode requests inside a trusted execution environment.
The Block reports the attacker could have observed user requests. Those requests were being processed on the compromised server that day. Those requests included ones in confidential mode. The enclave is designed to keep requests private even from NEAR AI itself. A vulnerability in the software running inside the enclave can still expose requests. SGLang ran inside the trusted execution environment.
The flaw reached legacy agents and account data
The attacker also reached 18 AI agents on a legacy deployment. That deployment did not run inside the enclave. It held chat history, settings and logs. Account details for approximately 100 users were exposed. Two customers had API keys written to logs, and NEAR AI revoked both.
NEAR AI has not named the CVE or the affected SGLang versions. The company reported the flaw to the SGLang project. It deployed a fix across its inference servers and rotated credentials. NEAR AI restored its Cloud service after the investigation.
The promise was confidential
Blockonomi reports NEAR AI sells confidential inference as a core product. Requests in confidential mode may have been visible on November 8. NEAR AI has not confirmed whether those requests were copied. The attacker had code execution where SGLang decrypts prompts to process them.
Remote attestation proves which code is loaded in the enclave. The enclave makes exploitable flaws harder for the operator to see.
What I would check in three Cole systems
Atelier keeps an optional profile and memory and voluntary feedback. The usage ledger records cost and time per request. Prompts and answers are never logged. If I ran an inference engine inside a TEE, I would check whether the engine had been audited for RCE flaws. I would check before I called it confidential.
A Keep Fix Cut report lives in page memory. Anonymous usage analytics are kept 30 days. I would check whether the model provider has disclosed a breach in the last quarter.
AI Trader is personal software with risk limits as hard caps in code. The trading assistant has no users but me. Every AI decision is stored with its inputs, output and cost. If I added a second model provider, I would want proof its inference stack had been patched for known RCE flaws. I would check the last 30 days.
The enclave kept the host out.
Somewhere a customer is reading the incident report. Confidential means the software you chose to run inside gets to see everything you sent it.