Skip to navigation

Threat reportData BreachTL-2026-5679

NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents

highMONITORING

An attacker exploited an unspecified remote code execution vulnerability in the open-source SGLang inference engine on a NEAR AI inference server, then reached an internal system behind the retired Private Chat feature. About 100 users' account details were downloaded, 18 legacy AI agents' chat history, settings and logs were accessed, and two NEAR AI Cloud customers' API keys exposed in logs were revoked.

Key facts

IdentifiersTL-2026-5679
SeverityHIGH
First disclosed
Affected productsSGLang project SGLang inference engine; NEAR AI NEAR AI inference servers, retired Private Chat internal system, legacy NEAR AI Agents deployment, NEAR AI Cloud
MITRE ATT&CK techniquesT1005 Data from Local System, T1059 Command and Scripting Interpreter, T1190 Exploit Public-Facing Application, T1213 Data from Information Repositories, T1552 Unsecured Credentials
MotivationUNKNOWN
Target sectorstechnology, artificial-intelligence, cloud-services
Target regionsGlobal
Detection rules9 (1 shown free)
Sources6 cited sources

Detection coverage

As of 2026-11-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5679 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SGLang Inference Server Spawning Shell or Download Utility (T1190 Post-RCE Execution)

Detects a shell, network utility or encoder launched directly by an SGLang inference server process on Linux. NEAR AI's SGLang RCE (TL-2026-5679, T1190) gave the attacker command execution on an inference server; a legitimate SGLang server does not normally fork interactive shells, curl/wget or netcat. Build tooling (nvcc, ninja, triton JIT) is excluded.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059, T1059.004, T1105
  • Data sources: sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
  • Severity: high
  • Confidence: high

Splunk SPL

index=linux sourcetype="sysmon:linux" EventID=1 (ParentCommandLine="*sglang*" OR ParentImage="*sglang*") (Image="*/bash" OR Image="*/sh" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat" OR Image="*/base64" OR Image="*/perl") NOT (CommandLine="*nvcc*" OR CommandLine="*ninja*" OR CommandLine="*triton*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_commands values(User) as users by host ParentCommandLine Image | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table first_seen last_seen host users ParentCommandLine Image child_commands count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has "sglang"
| where FileName in~ ("bash", "sh", "dash", "curl", "wget", "nc", "ncat", "socat", "base64", "perl")
| where ProcessCommandLine !has_any ("nvcc", "ninja", "triton")
| summarize Executions=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), ChildCommands=make_set(ProcessCommandLine, 20) by DeviceName, AccountName, InitiatingProcessCommandLine, FileName
| project FirstSeen, LastSeen, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ChildCommands, Executions

Sigma

title: SGLang Process Spawning Shell or Download Utility
id: 5a1c7e2e-3b64-4f0e-9d51-8a2f6c1b7d01
status: experimental
description: Detects a shell, network utility or encoder spawned directly by an SGLang inference server process, consistent with post-RCE command execution as in the NEAR AI SGLang breach (TL-2026-5679).
references:
    - https://near.ai/blog/security-incident-report-sglang-vulnerability
    - https://kb.cert.org/vuls/id/281278
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentCommandLine|contains: 'sglang'
    selection_child:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/socat'
            - '/base64'
            - '/perl'
    filter_build:
        CommandLine|contains:
            - 'nvcc'
            - 'ninja'
            - 'triton'
    condition: selection_parent and selection_child and not filter_build
falsepositives:
    - Operator wrapper scripts that launch SGLang through a shell and run health-check curl commands
    - GPU kernel JIT compilation helpers not covered by the build filter
level: high

Known false positives:

  • Wrapper or entrypoint shell scripts that launch SGLang and run curl health checks
  • GPU kernel JIT or build helpers spawned by SGLang that are not covered by the nvcc/ninja/triton exclusions

Tuning notes: Field names follow the Splunk Add-on for Sysmon for Linux (EventID, Image, ParentCommandLine); adapt if you ingest auditd or EDR data. Scope to the inference-server host group and add exclusions for known entrypoint scripts and health-check commands after a 7-day baseline.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Requests to [indicator] Unauthenticated Management and Pickle-Based Endpoints · unlock with TL Creds
  • Bulk Account and Agent Data Export via Database Dump or Query Tools · unlock with TL Creds
  • Inference Host Python Process Connecting to Public IPs on Non-Standard Ports · unlock with TL Creds
  • [indicator] Server Launched Listening on All Interfaces Without API Key · unlock with TL Creds
  • Archiving or Copying Agent and Chat History Data on Linux Host · unlock with TL Creds
  • Reverse Shell Command Patterns on Linux Host · unlock with TL Creds
  • Secret Hunting in Logs and Environment Files on Inference Host (API Keys in Logs) · unlock with TL Creds
  • Inference Host Python Process Pivoting to Internal Database and Admin Services · unlock with TL Creds

Indicators of compromise

As of 2026-11-10, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5679.

9 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

NEAR AI disclosed in a security incident report dated 2026-11-09 (relayed by Decrypt and The Block on 2026-11-10) that an attacker exploited a remote code execution (RCE) vulnerability in SGLang, the open-source engine NEAR AI uses to run AI models on its inference servers. The exploit gave the attacker command execution on one inference server. From that foothold the attacker reached other parts of NEAR AI's infrastructure; investigators traced the intrusion to an internal system connected to Private Chat, a feature NEAR AI had already retired.

From the Private Chat-connected system the attacker downloaded account details for approximately 100 users (names and email addresses for all; subscription plan and account balance for some). The attacker also accessed chat history, settings and logs of 18 agents on an older NEAR AI Agents deployment that did not run inside NEAR AI's confidential computing (TEE) environment. API keys for two NEAR AI Cloud customers appeared in logs and were revoked; the sources do not say whether the keys were used. NEAR AI states the attacker could also have observed requests being processed on the compromised server on November 8, including confidential-mode requests. NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed.

NEAR AI did not publish a CVE, the SGLang version, the exact initial-compromise or detection timestamps, or any indicators of compromise, and the attacker is not attributed. NEAR AI reported the vulnerability to the SGLang project. Decrypt notes that CERT/CC documented six SGLang vulnerabilities in July 2026 (VU#281278: CVE-2026-15969, -15971, -15974, -15976, -15977, -15978, covering unauthenticated pickle-deserialization RCE, dumper-subsystem sandbox escape, SSRF/local file read, RCE via torch.load on model weights, credential leakage via /server_info, and weight exfiltration); the sources give no basis to link that advisory to this breach and it is listed only as related context. NEAR AI stated that confidential computing protects data from the operator and host but does not protect against vulnerabilities in software running inside the environment.

Remediation per NEAR AI: all active sessions and administrative credentials revoked, all agent tokens replaced, Private Chat taken offline, the SGLang vulnerability fixed across all inference servers, remaining credentials rotated, a full forensic review completed, NEAR AI Cloud access paused then restored, affected users and the 18 agent owners notified individually, and regulatory notifications to be made where required. Users are warned to be wary of unsolicited messages referencing their NEAR AI accounts or balances.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552 Unsecured Credentials

Remediation

Patches

  • NEAR AI deployed a fix for the SGLang vulnerability on all of its inference servers; the specific flaw and version were not disclosed
  • Track SGLang releases and CERT/CC VU#281278 for upstream fixes

Immediate actions

  • Revoke all active sessions and administrative credentials on AI inference and management infrastructure
  • Replace agent tokens and rotate any API keys that appear in logs
  • Take retired or deprecated services such as legacy Private Chat systems offline
  • Restrict network access to SGLang service interfaces and keep them off untrusted networks

Workarounds

  • Per CERT/CC VU#281278: disable unused SGLang endpoints and set SGLANG_USE_PICKLE_IPC to false
  • Users: treat unsolicited messages referencing NEAR AI accounts or balances with caution

Longer-term hardening

  • Apply the same security analysis rigor to inference software and surrounding services as to the enclave
  • Scrub secrets from application and inference logs
  • Decommission legacy deployments that sit outside confidential computing boundaries
  • Segment inference servers from internal account, agent and administrative systems

Affected and fixed versions

  • SGLang project — SGLang inference engine
    Vulnerable versions: Unspecified version used on NEAR AI inference servers
    Fixed in: Fix deployed by NEAR AI on all inference servers; version not disclosed
  • NEAR AI — NEAR AI inference servers, retired Private Chat internal system, legacy NEAR AI Agents deployment, NEAR AI Cloud
    Vulnerable versions: Environment as of 2026-11-08
    Fixed in: Remediated per NEAR AI incident report of 2026-11-09

Timeline

  • CERT/CC VU#777338 (two SGLang RCE flaws and one path traversal) revised with no vendor statement; shown as related context for SGLang's advisory history, not linked to this breach
  • CERT/CC publishes VU#281278 documenting six SGLang vulnerabilities (RCE, SSRF, credential leakage, weight exfiltration); no patch or vendor statement at publication. Not linked to this breach by NEAR AI or the press
  • Attacker reaches an internal system behind the retired Private Chat feature, downloads account details of ~100 users and accesses chat history, settings and logs of 18 legacy agents; two Cloud customers' API keys found in logs. Dates for these steps are not stated in the sources
  • Attacker exploits an unspecified SGLang RCE on a NEAR AI inference server; per NEAR AI the attacker could have observed requests processed on that server on this date, including confidential-mode requests. Exact initial-compromise and detection times were not disclosed
  • NEAR AI publishes its security incident report; reports it has revoked sessions and admin credentials, replaced agent tokens, taken Private Chat offline, fixed SGLang on all inference servers, and completed a forensic review
  • Decrypt, The Block and DataBreaches.net report the breach

Sources cited

Drafted by the Threadlinqs research pipeline from 6 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats