SGLang RCE exploited in the wild to breach NEAR AI inference infrastructure

A threat actor exploited a remote code execution vulnerability in SGLang, the open-source AI inference engine, to gain code execution on one of NEAR AI's inference servers. Because SGLang itself ran inside NEAR AI's confidential-computing TEE, the attacker could observe in-flight requests — including those submitted in confidential mode — which the TEE does not protect against. From there they pivoted to a deprecated Private Chat backend (exfiltrating email/name/plan/balance for ~100 users) and to 18 AI agents on a legacy non-TEE deployment (chat history, settings, logs, and two exposed NEAR AI Cloud API keys).

This is confirmed in-the-wild exploitation of an AI inference engine, demonstrating that TEE/confidential-computing boundaries do not protect against vulnerabilities in the software running inside the enclave. It shows multi-tenant agent data and 'confidential' inference traffic are reachable once an inference engine is compromised, and that unpatched open-source inference components are a high-value attack surface. NEAR AI has not assigned a CVE yet; it reported the flaw to the SGLang project.

Remote, unauthenticated exploitation of a public-facing SGLang inference server (no CVE published yet), yielding arbitrary code execution on the inference worker inside the TEE boundary.

SGLang open-source inference engine (unpatched versions deployed at self-hosted providers); NEAR AI Cloud inference

Patch SGLang on all inference servers; apply the fix deployed across NEAR AI; rotate worker/cloud credentials and agent tokens; treat inference software and the enclave service as 'in the trust boundary' for security review. No public CVE/advisory yet — monitor SGLang project for the fix.