NEAR AI breach exposed the limits of confidential mode

A confidential AI request is not automatically safe from the software processing it. In a November 9 incident report, NEAR AI said an intruder exploited SGLang on an inference server and may have observed requests handled there on November 8, including confidential-mode traffic. The company says it patched the flaw, replaced affected credentials and restored cloud access.

An inference server is the computer that turns a question into a model's answer. Confidential computing puts that work inside a hardware-protected area, designed to keep the infrastructure operator from inspecting its contents. That is a valuable protection, but it addresses a particular adversary: someone outside the protected workload. It does not certify every program inside it as bug-free.

This distinction predates the incident. A June 2025 whitepaper from Pattern Labs and Anthropic describes how errors in enclave programs and their dependencies can compromise confidentiality. The model-serving software needs access to the inputs it processes. Protecting that workspace from the host does not remove vulnerabilities in the software doing the work. A locked consultation room offers privacy from the corridor; it cannot establish that everyone working inside is trustworthy.

There is a second distinction for buyers. Cloud Security Alliance's November 11 analysis explains that remote attestation can identify the software running in the protected environment. Identification is not a security audit. A vulnerable build can be exactly the build the verifier expected. Checking a chef's identity and checking a kitchen's hygiene are different jobs, even when both matter.

SGLang had already attracted security warnings. Carnegie Mellon University's CERT Coordination Center described six vulnerabilities in July, covering risks such as code execution, file access and credential disclosure. Its advice included restricting exposed interfaces and disabling unused endpoints. NEAR AI has not identified the specific vulnerability exploited here, so the July findings cannot be assigned as the cause of this incident.

The news is therefore not that encryption has been defeated, or that a new attack principle has been invented. It is a real incident illustrating the limits of a privacy promise. CSA argues that customers should examine patching and software exposure alongside hardware assurances. For someone considering sending private documents to an AI service, a confidential-mode label answers only part of the question: what protects the data, and what still has to be trusted?

Source dates: NEAR AI, November 9, 2026; CSA analysis, November 11, 2026. Compiled November 14, 2026, 01:37 Beijing / November 13, 2026, 12:37 EST.