NEAR AI Pauses Cloud Inference After Internal Breach, Then Restores Service

NEAR AI paused NEAR AI Cloud inference on November 9, 2026 after detecting unauthorized access to internal systems, then restored the service on November 10 after patching servers and rotating credentials. The sequence is a live stress test for vendors selling confidential AI inference through trusted execution environments (TEEs) rather than policy promises alone.

If you route sensitive prompts through NEAR AI Cloud, Brave Leo's private path, or OpenRouter providers that pin NEAR-hosted models, treat this as both availability and trust news until NEAR AI publishes its full incident report.

TL;DR

Update (November 10, 2026): SGLang RCE scope and TEE limits

NEAR AI published a full incident report on November 9, 2026 with more detail than its first X threads summarized by outlets. The attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on NEAR's servers, gaining code execution on one inference host and lateral movement into internal systems.

Confirmed data categories:

• ~100 user accounts from deprecated Private Chat backends: email, name, and for some users plan and balance fields.
• 18 agents on a legacy NEAR AI Agents deployment outside TEE isolation: chat history, settings, and logs.
• Two NEAR AI Cloud API keys exposed in logs, now revoked.
• In-flight requests on the compromised server on November 8, including workloads labeled confidential, may have been observed during processing.

NEAR AI states stored Private Chat conversations and uploads were not accessed, per its investigation to date. That is a vendor forensic claim, not independent verification.

Response actions listed: revoke sessions and admin credentials, rotate agent tokens, take Private Chat offline, patch SGLang on all inference servers, complete credential rotation, and notify affected users from security@near.ai.

Confidential inference caveat: NEAR AI explains TEEs protect data from the host operator, not from RCE inside the enclave workload. A vulnerable inference stack can read prompts while they are being processed. NEAR says it reported the issue upstream to the SGLang project and will treat inference software with the same audit rigor as enclave hardware. For a parallel where a KV cache bug exposed other customers' context, see Cloudflare Workers AI and SGLang.

If you self-host SGLang, align versions with patched releases such as 0.5.10 cited in GitHub advisories for related RCE issues (CVE-2026-3059 and CVE-2026-3060), and verify NEAR's specific flaw mapping when SGLang publishes its own bulletin.

Timeline from NEAR AI's public updates

Beads escaping a cracked vessel, illustrating operational pause after unauthorized internal access

We could not fetch X directly in this environment. The timeline below follows @near_ai posts as summarized by ChainCatcher, TechFlow, and CryptoBriefing's November 9–10 coverage.

November 9 (initial): NEAR AI said it discovered unauthorized access to internal systems and paused NEAR AI Cloud inference while investigating. It emphasized that inference on NEAR AI Cloud runs inside hardware-isolated secure enclaves (TEEs) to protect customer prompt privacy. It stated NEAR Protocol and other NEAR services were not affected and promised another update within about two hours.

November 9 (follow-up): A later post described closing the unauthorized access while completing the investigation. NEAR AI Cloud stayed paused until safe restoration.

November 10: Updates summarized by PANews and TechFlow say NEAR AI Cloud is back online, vulnerabilities on all servers were fixed, and affected credentials were rotated, with a full incident report coming soon.

Until that report ships, treat scope, dwell time, and data categories as unconfirmed beyond NEAR AI's TEE narrative.

What NEAR AI Cloud is in this incident

NEAR AI markets confidential, verifiable inference for partners such as Brave Leo and routes on OpenRouter. Its blog positions Intel TDX and NVIDIA confidential computing as the hardware base, with attestation customers can verify.

The November breach is awkward against that pitch: attackers reportedly reached operator-internal systems, while NEAR AI argues customer enclave payloads stayed isolated.

That distinction matters architecturally. A control-plane compromise can still:

• Disrupt service (as happened with the pause).
• Tamper with attestation or routing if attackers reached orchestration layers.
• Exfiltrate metadata such as billing, keys, or tenant configs even when prompts stay encrypted in enclaves.

NEAR AI has not, in the materials we reviewed, itemized which internal subsystems were touched.

Connection to NEAR AI Red and uncensored models

On October 29, 2026, NEAR AI announced cybersecurity models and NEAR AI Red, pitching abliterated, uncensored models for defensive research inside the same confidential stack. A November 9 internal breach lands in the same news cycle as that launch.

Security teams evaluating NEAR for red-team automation should separate model policy (uncensored weights) from operator security (who can reach the orchestrator). This incident is about the second layer.

What TEE isolation does and does not prove

Encrypted data path through a closed lock-shaped channel for confidential AI inference

NEAR AI's public reassurance follows a standard confidential-computing story:

• Prompts and outputs should be opaque to the host operator when enclaves are configured correctly.
• Operator compromise should not automatically equal plaintext prompt theft.

What TEE marketing cannot by itself prove:

• That this specific intrusion never touched enclave keys or attestation endpoints.
• That metadata (timestamps, model IDs, token volumes) stayed private.
• That future patches did not change trust roots customers pinned.

Independent confirmation waits on NEAR AI's full incident report and any third-party review they commission.

Outage impact for builders

A pause of NEAR AI Cloud inference affects:

• Direct API users on NEAR AI Cloud.
• OpenRouter routes that pin NEAR-hosted models.
• Brave Leo private inference paths backed by NEAR AI Cloud.
• Integrations such as OpenCode setups NEAR documents for private inference.

If your production route failed over automatically, still rotate keys issued before November 10 restoration. Assume long-lived tokens might have been reachable in a internal-systems breach until NEAR AI denies that explicitly.

Compare operational response patterns to other 2026 inference incidents, including Fireworks AI's October bulletin expansion and Cloudflare Workers AI KV cache issues, which show how platform breaches cascade into customer key rotation work even when model weights stay put.

What to do while waiting on the full report

1. Rotate NEAR AI API keys and any OpenRouter keys scoped to NEAR providers.
2. Re-run attestation checks on environments that pinned NEAR enclave measurements.
3. Review November 9–10 logs for anomalous model calls or credit burn.
4. Document failover if Leo or OpenRouter silently switched models during the pause.
5. Track NEAR AI's incident report for explicit data categories, not only TEE restatements.

Limiting agent blast radius on inference keys

NEAR AI is one node in a wider LLMjacking economy where stolen inference keys become resale gateways. Cap per-key budgets, scope model allowlists, and avoid sharing one org-wide token across unrelated agents.

Teams orchestrating autonomous agents should pair provider rotation with runtime guardrails such as AgentBeam, which stops risky tool calls before they execute, reducing what a leaked inference key can trigger even after rotation.

Claims vs verified (November 10 snapshot)

Why this story matters beyond NEAR

Confidential inference vendors are selling "assume we're lying — verify" narratives, as NEAR AI's own blog titles put it. A real operator breach is the moment customers must run the verification story, not just read it.

For enterprise architects, the lesson parallels Australia's November 10 push for rapid AI incident reporting: inference platforms are critical infrastructure even when blockchains stay online.

Attestation, OpenRouter, and the verify-it-yourself pitch

NEAR AI's blog has spent months telling customers to verify enclaves rather than trust marketing. Posts such as Assume We're Lying: How to Verify Private Inference walk through attestation checks on NEAR AI Cloud.

After an internal systems breach, those guides become runbooks, not thought leadership. Security engineers should:

• Capture attestation quotes from before November 9 if you logged them.
• Compare post-restoration measurements to your pinned expectations.
• Treat any drift as incident scope, not routine rotation, until NEAR AI explains it.

OpenRouter integrations add another hop. If your app pins provider: near-ai routes, a NEAR pause can surface as silent model fallback unless you monitor provider health. Log provider IDs per request the same way you log model IDs.

For Brave Leo users, private paths documented in our Brave Leo NEAR TEE write-up depend on NEAR remaining both available and trustworthy. Consumer products rarely expose attestation UI; enterprises should still run periodic verification scripts on representative clients.

Questions for NEAR AI's promised incident report

When the full report lands, these are the fields practitioners should scan first:

1. Initial access vector — phishing, dependency, cloud misconfig, or insider?
2. Dwell time between first access and detection.
3. Whether orchestration keys for enclave launch were in scope.
4. Customer API keys — rotated only as precaution or confirmed exfiltration?
5. Telemetry or billing metadata exposure separate from prompts.
6. Third-party forensics vendor and whether customers can receive excerpts under NDA.

Until those answers exist, assume rotation and re-verify trust roots.

Procurement checklist for confidential inference vendors

Security reviews should treat NEAR-like vendors as dual-plane suppliers:

NEAR's separation of NEAR Protocol from NEAR AI Cloud is architecturally sound, yet customers still experience single-vendor operational risk when inference pauses.

Document an inference provider failover in your runbooks the same way you document region failures. A confidential stack without uptime is still a single point of failure for product features that marketed privacy.

Related reading

• Brave Leo on NEAR AI Cloud TEEs — How Leo pins private inference.
• NEAR AI Putnam bench cost story — Product context for NEAR-hosted models.
• Fireworks AI October incident update — Another inference provider breach playbook.
• Let's Encrypt confidential computing GPU goals — Broader attestation ecosystem.
• Australia mandatory AI incident reporting — Policy pressure on AI operators after agent incidents.
• OpenAI Control Room kill switch — Research-side halt design contrast.