# NEAR AI breach via SGLang remote code execution exposes ~100 user accounts and 18 legacy AI agents

> An attacker exploited an unspecified remote code execution vulnerability in the open-source SGLang inference engine on a NEAR AI inference server, then reached an internal system behind the retired Private Chat feature. About 100 users' account details were downloaded, 18 legacy AI agents' chat history, settings and logs were accessed, and two NEAR AI Cloud customers' API keys exposed in logs were revoked.

- **Published:** 2026-11-10T20:54:55Z
- **Last reviewed:** 2026-11-10T20:54:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5679
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5679.png
- **ID:** TL-2026-5679
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

NEAR AI disclosed in a security incident report dated 2026-11-09 (relayed by Decrypt and The Block on 2026-11-10) that an attacker exploited a remote code execution (RCE) vulnerability in SGLang, the open-source engine NEAR AI uses to run AI models on its inference servers. The exploit gave the attacker command execution on one inference server. From that foothold the attacker reached other parts of NEAR AI's infrastructure; investigators traced the intrusion to an internal system connected to Private Chat, a feature NEAR AI had already retired.

From the Private Chat-connected system the attacker downloaded account details for approximately 100 users (names and email addresses for all; subscription plan and account balance for some). The attacker also accessed chat history, settings and logs of 18 agents on an older NEAR AI Agents deployment that did not run inside NEAR AI's confidential computing (TEE) environment. API keys for two NEAR AI Cloud customers appeared in logs and were revoked; the sources do not say whether the keys were used. NEAR AI states the attacker could also have observed requests being processed on the compromised server on November 8, including confidential-mode requests. NEAR AI found no indication that stored Private Chat conversations or uploaded files were accessed.

NEAR AI did not publish a CVE, the SGLang version, the exact initial-compromise or detection timestamps, or any indicators of compromise, and the attacker is not attributed. NEAR AI reported the vulnerability to the SGLang project. Decrypt notes that CERT/CC documented six SGLang vulnerabilities in July 2026 (VU#281278: CVE-2026-15969, -15971, -15974, -15976, -15977, -15978, covering unauthenticated pickle-deserialization RCE, dumper-subsystem sandbox escape, SSRF/local file read, RCE via torch.load on model weights, credential leakage via /server_info, and weight exfiltration); the sources give no basis to link that advisory to this breach and it is listed only as related context. NEAR AI stated that confidential computing protects data from the operator and host but does not protect against vulnerabilities in software running inside the environment.

Remediation per NEAR AI: all active sessions and administrative credentials revoked, all agent tokens replaced, Private Chat taken offline, the SGLang vulnerability fixed across all inference servers, remaining credentials rotated, a full forensic review completed, NEAR AI Cloud access paused then restored, affected users and the 18 agent owners notified individually, and regulatory notifications to be made where required. Users are warned to be wary of unsolicited messages referencing their NEAR AI accounts or balances.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SGLang Inference Server Spawning Shell or Download Utility (T1190 Post-RCE Execution)** (`TL-2026-5679-SPL-001`)

Detects a shell, network utility or encoder launched directly by an SGLang inference server process on Linux. NEAR AI's SGLang RCE (TL-2026-5679, T1190) gave the attacker command execution on an inference server; a legitimate SGLang server does not normally fork interactive shells, curl/wget or netcat. Build tooling (nvcc, ninja, triton JIT) is excluded.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.004, T1105
- **Data sources:** sysmon_for_linux, linux_process_creation, defender_for_endpoint_linux
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventID=1 (ParentCommandLine="*sglang*" OR ParentImage="*sglang*") (Image="*/bash" OR Image="*/sh" OR Image="*/dash" OR Image="*/curl" OR Image="*/wget" OR Image="*/nc" OR Image="*/ncat" OR Image="*/socat" OR Image="*/base64" OR Image="*/perl") NOT (CommandLine="*nvcc*" OR CommandLine="*ninja*" OR CommandLine="*triton*") | stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_commands values(User) as users by host ParentCommandLine Image | eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S") | table first_seen last_seen host users ParentCommandLine Image child_commands count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessCommandLine has "sglang"
| where FileName in~ ("bash", "sh", "dash", "curl", "wget", "nc", "ncat", "socat", "base64", "perl")
| where ProcessCommandLine !has_any ("nvcc", "ninja", "triton")
| summarize Executions=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), ChildCommands=make_set(ProcessCommandLine, 20) by DeviceName, AccountName, InitiatingProcessCommandLine, FileName
| project FirstSeen, LastSeen, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ChildCommands, Executions
```

### Sigma

```yaml
title: SGLang Process Spawning Shell or Download Utility
id: 5a1c7e2e-3b64-4f0e-9d51-8a2f6c1b7d01
status: experimental
description: Detects a shell, network utility or encoder spawned directly by an SGLang inference server process, consistent with post-RCE command execution as in the NEAR AI SGLang breach (TL-2026-5679).
references:
    - https://near.ai/blog/security-incident-report-sglang-vulnerability
    - https://kb.cert.org/vuls/id/281278
author: Threadlinqs Team
date: 2026-11-10
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.004
    - attack.command-and-control
    - attack.t1105
logsource:
    category: process_creation
    product: linux
detection:
    selection_parent:
        ParentCommandLine|contains: 'sglang'
    selection_child:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/dash'
            - '/curl'
            - '/wget'
            - '/nc'
            - '/ncat'
            - '/socat'
            - '/base64'
            - '/perl'
    filter_build:
        CommandLine|contains:
            - 'nvcc'
            - 'ninja'
            - 'triton'
    condition: selection_parent and selection_child and not filter_build
falsepositives:
    - Operator wrapper scripts that launch SGLang through a shell and run health-check curl commands
    - GPU kernel JIT compilation helpers not covered by the build filter
level: high
```

**Known false positives:**

- Wrapper or entrypoint shell scripts that launch SGLang and run curl health checks
- GPU kernel JIT or build helpers spawned by SGLang that are not covered by the nvcc/ninja/triton exclusions

**Tuning notes:** Field names follow the Splunk Add-on for Sysmon for Linux (EventID, Image, ParentCommandLine); adapt if you ingest auditd or EDR data. Scope to the inference-server host group and add exclusions for known entrypoint scripts and health-check commands after a 7-day baseline.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Requests to [indicator] Unauthenticated Management and Pickle-Based Endpoints (locked: unlock with TL Creds)
- Bulk Account and Agent Data Export via Database Dump or Query Tools (locked: unlock with TL Creds)
- Inference Host Python Process Connecting to Public IPs on Non-Standard Ports (locked: unlock with TL Creds)
- [indicator] Server Launched Listening on All Interfaces Without API Key (locked: unlock with TL Creds)
- Archiving or Copying Agent and Chat History Data on Linux Host (locked: unlock with TL Creds)
- Reverse Shell Command Patterns on Linux Host (locked: unlock with TL Creds)
- Secret Hunting in Logs and Environment Files on Inference Host (API Keys in Logs) (locked: unlock with TL Creds)
- Inference Host Python Process Pivoting to Internal Database and Admin Services (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [NEAR AI Security Incident Report: SGLang Vulnerability](https://near.ai/blog/security-incident-report-sglang-vulnerability)
- [Near AI Breach Exposes User Details and Data From 18 AI Agents (Decrypt)](https://decrypt.co/382965/near-ai-breach-exposes-user-details-data-ai-agents)
- [NEAR AI says SGLang vulnerability exposed user account details in security breach (The Block)](https://www.theblock.co/news/defi/2026-11-10-near-ai-security-breach-437002)
- [NEAR AI breach exposes user details and data from 18 AI agents (DataBreaches.net)](https://databreaches.net/2026/11/10/near-ai-breach-exposes-user-details-and-data-from-18-ai-agents/)
- [CERT/CC VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure](https://kb.cert.org/vuls/id/281278)
- [CERT/CC VU#777338: SGLang RCE and path traversal vulnerabilities](https://kb.cert.org/vuls/id/777338)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5679