SGLang RCE on one NEAR AI server exposed that day's confidential requests; no CVE named

Last Sunday an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine, and ran code on one NEAR AI inference server, according to the company's incident report as carried by The Hacker News. SGLang was running inside the trusted execution environment used for confidential mode. That is how the attacker could see requests processed on that server that day, including confidential-mode traffic. The company states the TEE does not protect against a flaw in software running inside the environment. The intrusion path was closed only after the attacker had already moved deeper into NEAR AI systems.

What the evidence trail shows is a self-reported intrusion, not a published forensic package. NEAR AI says the attacker reached an internal system behind already-deprecated Private Chat and downloaded details for about 100 users: emails, names, and for some accounts plan and balance data. It reports no access to stored conversations or uploaded files. From 18 agents on an older non-TEE deployment, the attacker took chat history, settings, and logs. Two customers' Cloud API keys in those logs were revoked. It says sessions and admin credentials were revoked, agent tokens replaced, Private Chat taken offline, and a forensic review completed.

Official claims and independent evidence diverge here. The record is NEAR AI's report via The Hacker News. No CVE, no versions, no patch commit, no indicators, no named actor. Nothing independent confirms or disputes it. Do not call the bug critical without a CVSS score. Confidential mode hides requests from the operator. It does not survive code compromise inside the enclave. Brave's October 15 note put Leo chats on GLM 5.3 Flash in a NEAR AI TEE. The company has not said if this server was involved.

The operational picture is larger than 100 accounts and 18 agents. Any shop running SGLang inside a TEE had the same blind spot until affected versions are named and an upstream fix is confirmed. The pivot itself was ordinary: a deprecated Private Chat backend still reachable, and customer API keys sitting in agent logs. That is secrets hygiene, not a novel enclave break. Watch for a SGLang advisory that names versions, and for a yes-or-no on Leo traffic and on notice to people whose requests crossed that server Sunday. Until both exist, exposure cannot be scoped.