As reported by The Hacker News, NEAR AI disclosed a breach this week in which an attacker exploited a remote code execution (RCE) vulnerability in SGLang, an open-source LLM inference engine, to compromise one of its inference servers. The attacker accessed in-flight requests—including those processed inside a trusted execution environment (TEE)—and pivoted laterally to reach a deprecated internal system and older AI agent deployments. Data from approximately 100 users and 18 AI agents was exposed, including two customers' Cloud API keys found in logs.
What This Incident Really Tells Us
The headline is "RCE in SGLang," but the real story is broader and more uncomfortable for the industry. NEAR AI built a confidentiality guarantee on TEE technology—a hardware-isolated enclave designed so that even the cloud provider cannot see the data. That is a legitimate and increasingly popular architecture for sensitive AI workloads. But NEAR AI itself acknowledged the core limitation:
The TEE does not protect against a vulnerability in the software running inside the environment.
This is the gap that most organizations deploying confidential computing do not fully internalize. A TEE guarantees that the host cannot see inside. It does not guarantee that the code inside is free of exploitable flaws. If the inference engine running in the enclave has an RCE, the attacker is now inside the trust boundary with full access to every request passing through. The confidentiality model collapses not because the hardware failed, but because the software layer was never part of the threat model.
Vulnerability Profile
| Field | Detail |
|---|---|
| CVE Identifier | Not disclosed by NEAR AI or SGLang project (notable gap) |
| Severity | Unspecified; RCE class typically Critical (CVSS 9.0+) |
| Affected Product | SGLang open-source inference engine (versions not disclosed) |
| Upstream Patch | Status unclear; NEAR AI states it deployed a fix on its servers |
| Active Exploitation | Confirmed in the wild against NEAR AI infrastructure |
The Disclosure Problem Is the Bigger Threat
What concerns Shield53 more than the breach itself is the absence of a CVE, affected version list, or upstream advisory. SGLang is an open-source project used across the AI inference ecosystem—if the flaw that NEAR AI patched locally is not disclosed and fixed upstream, every other SGLang deployment is potentially exposed. This is a supply chain risk: one vendor's incident becomes everyone's latent vulnerability. The AI infrastructure stack has not yet matured its disclosure practices to the standard set by traditional enterprise software, and incidents like this make that gap painfully visible.
The exposure of API keys in logs is a secondary but important finding. Secrets in application and agent logs remain one of the most common causes of credential compromise. NEAR AI did the right thing by revoking both keys, but the fact that keys were present in logs at all points to a secrets hygiene gap that predates this incident.
Who Is at Risk
Shield53 Recommendations
- Do not treat TEEs as a complete confidentiality solution. They protect against host-side threats, not against exploitable application code inside the enclave. Layer application hardening, input validation, and runtime detection on top.
- Audit your inference stack supply chain. Identify every open-source component in your AI serving path, track its CVE history, and subscribe to project security advisories. If SGLang is in your stack, contact the project for patch status immediately.
- Implement secrets scanning on logs. API keys, tokens, and credentials should never appear in application or agent logs. Deploy automated secrets detection in your logging pipeline and rotate any credentials found in historical logs.
- Enforce network segmentation around inference servers. The lateral movement from the inference server to deprecated internal systems should not have been possible. Apply zero-trust microsegmentation and decommission unreachable systems.
- Demand disclosure transparency from your AI providers. If your vendor will not share their inference engine, version, and patch status, you cannot assess your risk. Make this a procurement requirement.
- Rotate any API keys associated with NEAR AI Cloud if you were a customer, even if you were not directly notified. Treat the notification scope as potentially incomplete.
This incident is a reminder that the AI infrastructure layer is now production-critical and production-exposed. The industry needs the same disclosure discipline, patch management rigor, and segmentation hygiene that we expect from traditional cloud infrastructure—and it needs it before the next RCE, not after.
