{"slug": "near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server", "title": "NEAR AI says SGLang flaw let attacker into its infrastructure, including a server handling confidential-mode requests", "summary": "NEAR AI reported in a Nov. 9 incident report that an attacker exploited a vulnerability in the open-source SGLang inference engine to run code on one of its servers and gain access to its infrastructure, including a server handling confidential-mode requests. NEAR AI said it fixed the vulnerability on its servers and reported it to the SGLang project, but the report did not identify the flaw, confirm an upstream fix, or establish whether a fix was available to other SGLang operators. The disclosure matters because NEAR markets confidential inference as protection for user data, and the report says the SGLang flaw reached requests inside that environment.", "body_md": "# NEAR AI says SGLang flaw let attacker into its infrastructure, including a server handling confidential-mode requests\n\n**The company says the attacker could have seen requests on one inference server, including ones running in confidential mode.**\n\n        By [Emerson Redding](https://runtimewire.com/author/emerson-redding)\n        · Published \n\nPrimary source: [near.ai](https://near.ai/blog/security-incident-report-sglang-vulnerability)\n\n## Why it matters\n\nNEAR markets confidential inference as protection for user data, and its report says a flaw in the open-source inference engine reached requests inside that environment.\n\nNEAR AI said an attacker exploited a vulnerability in the open-source SGLang inference engine to run code on one of its servers and gain access to its infrastructure.\n\nIn a [Nov. 9th incident report](https://near.ai/blog/security-incident-report-sglang-vulnerability), the company said it had fixed the vulnerability on its servers and reported it to the SGLang project. The report did not identify the flaw, confirm an upstream fix or establish whether a fix was available to other SGLang operators.…\n\nWhen you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.", "url": "https://wpnews.pro/news/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server", "canonical_source": "https://runtimewire.com/article/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server", "published_at": "2026-11-10 17:18:39+00:00", "updated_at": "2026-11-10 20:21:56.796804+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-policy"], "entities": ["NEAR AI", "SGLang", "Emerson Redding"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server", "markdown": "https://wpnews.pro/news/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server.md", "text": "https://wpnews.pro/news/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server.txt", "jsonld": "https://wpnews.pro/news/near-ai-says-sglang-flaw-let-attacker-into-its-infrastructure-including-a-server.jsonld"}}