SGLang RCE Breach at NEAR AI: When Your AI Inference Engine Becomes the Attack Surface
Executive Summary
Executive Summary In November 2026, an attacker exploited a remote code execution vulnerability in SGLang, an open-source AI inference engine, to compromise one of NEAR AI's inference servers. The breach occurred on a Sunday and allowed the attacker to observe requests processed on that server—including those submitted in confidential mode inside a trusted execution environment (TEE)—because SGLang itself ran within the TEE boundary. The attacker subsequently pivoted to an internal system tied to the deprecated Private Chat product, exfiltrating account details (email addresses, names, plan and balance data) for approximately 100 users, and accessed 18 AI agents on a legacy deployment, stealing chat history, settings, logs, and two API keys.
This incident underscores a rapidly maturing threat vector: AI and ML inference infrastructure is increasingly being targeted through supply-chain and open-source component vulnerabilities. As enterprises accelerate AI adoption, unpatched inference engines, poorly segmented agent deployments, and TEE misconceptions create exploitable gaps that traditional perimeter security does not address.
Why This Matters Now
Why This Matters NowAI inference engines like SGLang are now critical production infrastructure, yet they frequently lack the patch cadence, network segmentation, and runtime monitoring applied to conventional workloads. With agentic AI deployments proliferating across cloud environments in 2026, a single unpatched RCE in an inference layer can expose multi-tenant agent data, API credentials, and sensitive user interactions at scale—making AI/ML infrastructure a high-priority target for adversaries.
Attack Path Analysis
Attack Path AnalysisAn attacker exploited an unpatched remote code execution vulnerability in the SGLang open-source inference engine running inside NEAR AI's trusted execution environment (TEE), gaining initial code execution on an inference server and observing live inference requests including those marked confidential. From that foothold, the attacker pivoted laterally to an internal legacy system backing the deprecated Private Chat product and to an older non-TEE NEAR AI Agents deployment, exfiltrating account details for approximately 100 users, chat history, settings, logs, and two cloud API keys from 18 AI agents before the breach was detected and contained.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker exploited a remote code execution (RCE) vulnerability in SGLang, an open-source LLM inference engine, which was deployed inside NEAR AI's trusted execution environment (TEE). Because the TEE does not protect against software vulnerabilities running within it, the exploit granted the attacker arbitrary code execution on the inference server, exposing live inference requests including those submitted in confidential mode.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesExploit Public-Facing Application
Command and Scripting Interpreter
Unsecured Credentials
File and Directory Discovery
Remote Services
Data from Cloud Storage
Exfiltration Over C2 Channel
Valid Accounts
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Flaw Remediation and Vulnerability Scanning
Control ID: SI-2 / RA-5
GDPR (EU) 2016/679 – Security of Processing and Breach Notification
Control ID: Article 32 / Article 33
NIS2 Directive (EU) 2022/2555 – Cybersecurity Risk Management Measures and Incident Reporting
Control ID: Article 21 / Article 23
DORA (EU) 2022/2554 – ICT Security and Patch Management
Control ID: Article 9 / Article 10
CISA Zero Trust Maturity Model 2.0 – Application-Level Segmentation and Data Access Controls
Control ID: Application Pillar — Visibility and Analytics / Data Pillar — Access
ISO/IEC 27001:2022 – Management of Technical Vulnerabilities and Secure Development Lifecycle
Control ID: Annex A 8.8 / Annex A 8.25
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Information Technology/IT
AI/ML infrastructure exploitation via SGLang RCE exposes IT sectors to agent data theft, credential exfiltration, and TEE bypass risks demanding Zero Trust Segmentation and egress policy enforcement.
Internet
NEAR AI's cloud inference platform breach affecting 100 users and 18 agents highlights internet-hosted AI service risks including lateral movement, unencrypted transit exposure, and API key compromise.
Computer Software/Engineering
Open-source SGLang inference engine RCE vulnerability demonstrates critical software supply chain risks, requiring inline IPS, CNSF fabric controls, and rigorous CVE disclosure processes for AI runtime environments.
Research Industry
AI research platforms like NEAR AI processing confidential inference requests face data exfiltration of chat history, logs, and user PII, requiring multicloud visibility and encrypted traffic protection per NIST.800-53.SC-12.
Sources
Sources- SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Usershttps://thehackernews.com/2026/11/sglang-rce-exploit-breaches-near-ai.htmlVerified
- NEAR AI Security Incident Report - SGLang Vulnerabilityhttps://near.ai/blog/security-incident-report-sglang-vulnerabilityVerified
- Brave Browser Leo AI Assistant End-to-End Encryption with NEAR AI TEEhttps://brave.com/blog/browser-ai-e2ee/Verified
- NEAR AI Follow-up Statement on Security Incidenthttps://x.com/near_ai/status/2120043366444601458Verified
- SGLang GitHub Repository - Open Source LLM Inference Enginehttps://github.com/sgl-project/sglangVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's ability to move from a compromised TEE-hosted inference server into unrelated legacy internal systems reveals a fundamental absence of workload-level segmentation and east-west enforcement. Had identity-aware segmentation and controlled egress policies been in place, the attacker's reachability across inference, Private Chat, and agent infrastructure would likely have been significantly constrained, reducing the overall blast radius of the breach.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: A Zero Trust fabric applied at the workload perimeter could limit the network-accessible attack surface of the SGLang inference server, reducing the number of reachable endpoints and protocols exposed to potential exploit traffic, which may have constrained the conditions under which the RCE vulnerability was reachable in the first place.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation enforcing least-privilege, identity-scoped access policies could limit how far harvested service credentials or tokens would actually reach within the broader environment, reducing the scope of internal resources accessible even if the attacker successfully extracted identity material from the compromised runtime.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely have constrained the attacker's ability to reach the Private Chat backend and the non-TEE agents deployment from the compromised inference server, since those communication paths would need to be explicitly permitted rather than implicitly available across the internal network.
Control: Multicloud Visibility & Control
Mitigation: Centralized multicloud visibility and traffic monitoring could make the attacker's sustained internal enumeration and API activity more likely to surface as anomalous east-west flows, potentially reducing dwell time by giving security teams earlier signals that unusual internal communication patterns were occurring across the inference and legacy service boundaries.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement could limit the outbound data paths available from compromised internal workloads, reducing the likelihood that large volumes of user records and agent data could be transferred out of the environment without matching an explicitly permitted egress flow, potentially constraining the attacker's ability to exfiltrate data at the observed scale.
Had segmentation and egress controls reduced the attacker's lateral reach and outbound data paths earlier in the attack chain, the residual impact would likely have been confined to the initially compromised inference server rather than spreading to legacy user data stores and agent deployments, meaningfully reducing the number of affected users and the volume of extracted credentials and operational data.
Impact at a Glance
Affected Business Functions
- AI Inference API Services (NEAR AI Cloud)
- Private Chat User Data and Conversation Storage
- AI Agent Orchestration and Deployment
- Trusted Execution Environment (TEE) Confidential Compute
Estimated downtime: 2 days
Estimated loss: N/A
Personally identifiable information (PII) including email addresses and full names for approximately 100 users of the deprecated Private Chat product; account plan and balance details for a subset of those users; chat history, configuration settings, and operational logs for 18 AI agents hosted on a non-TEE deployment of NEAR AI Agents; two NEAR AI Cloud API keys exposed in agent logs (both revoked); inference request content including confidential-mode requests processed through the compromised server on the day of the attack, potentially including third-party user prompts routed through Brave browser's Leo AI assistant integration with NEAR AI.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Cloud Native Security Fabric (CNSF) inline enforcement and real-time inspection around AI/ML inference workloads, including those inside TEEs, to detect and block exploit traffic patterns associated with RCE attempts against frameworks like SGLang before code execution occurs.
- • Enforce Zero Trust Segmentation and East-West Traffic Security controls to microsegment inference servers from internal legacy systems and agent deployments so that a compromised inference node cannot pivot to unrelated internal services without identity-based policy approval.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and data loss prevention on all outbound paths from AI inference and agent infrastructure to block unauthorized exfiltration of user account data, agent logs, and API credentials to unknown destinations.
- • Apply Multicloud Visibility and Control to establish behavioral baselines for inference server traffic and agent API interactions, enabling anomaly detection that flags unusual data access volumes, cross-service API calls, or bulk account enumeration consistent with post-exploitation activity.
- • Enforce Inline IPS (Suricata) signature-based detection on traffic entering and leaving SGLang and agent deployment endpoints to identify known exploit payloads and malicious request patterns, complemented by immediate CVE-based signature updates whenever new RCE vulnerabilities are disclosed in open-source AI inference engines.
