Daily Crypto Briefs 
CASABLANCA, November 10, 2026
NEAR AI said it restored its cloud service after an attacker exploited a flaw in software on one of its servers and downloaded account details for about 100 users, a breach that also left some requests running in confidential mode potentially visible.
The attacker gained access through one server that runs AI models, according to a security report dated Nov. 9. NEAR AI confirmed that the attacker retrieved data from 18 legacy agents and that API keys for two Cloud customers were exposed. The company revoked those keys.
As of 13:46 UTC Tuesday, NEAR AI had disclosed no crypto theft, affected wallets or on-chain losses from the breach. The company said the underlying blockchain was unaffected in public updates reported by The Crypto Times.
ChartExchange data showed the NEAR token rose 1.2% to $3.63 in Monday’s UTC session, after falling 4.0% Sunday. Monday’s close was about 26% below its level a month earlier. Bitcoin rose 0.6% Monday to $75,259.
NEAR
NEARNEAR AI details account and API key exposure
The account records came from an internal system behind Private Chat, a product the company had already retired. The data included names and email addresses and, for some accounts, subscription plan and balance information. NEAR AI said it found no indication that the intruder accessed stored Private Chat conversations or uploaded files.
The 18 agents ran on an older version of NEAR AI Agents, outside the company’s hardware-isolated computing environment. The attacker retrieved their chat histories, settings and logs. NEAR AI said the two customer API keys appeared in logs. Cloud applications use those keys to authenticate requests to the service.
NEAR AI did not say whether the keys were used before it revoked them. It reported exposure by category and did not give an overall count of unique affected customers or say how much the incident cost.
The findings describe a different kind of breach from the NEAR Intents exploit, when the separate trading system reported roughly $3.8 million in losses that it later recovered. The Cloud disclosure accounts for accessed records and credentials.
SGLang flaw put live AI requests at risk
The attacker exploited a vulnerability in SGLang, open-source software that runs AI models and serves their responses. NEAR AI said the flaw let the attacker run code on one inference server and reach other parts of its infrastructure from there.
On Nov. 8, the intruder could also have observed requests while the compromised server processed them, including requests in confidential mode. The report gave no count for those requests and did not establish whether any particular prompt was captured.
When it launched Cloud and Private Chat in December 2025, NEAR AI said prompts were decrypted for processing inside a hardware-isolated environment. In its incident report, the company said that design protects against access by the host or operator. Code running inside the protected environment can still have flaws of its own.
The distinction applies to services built on the same infrastructure. In October, Brave said users of its Leo assistant could select a model that sends encrypted prompts to NEAR AI’s protected servers. The incident report did not name Brave or identify which Cloud customers sent requests to the server in question.
NEAR AI restores Cloud and alerts affected users
The company said it blocked the attacker’s access, ended active sessions, revoked administrative credentials and replaced agent tokens. It patched SGLang across its inference servers and restored NEAR AI Cloud. Private Chat was taken offline, and the company said it had completed its forensic review and remaining credential changes.
NEAR AI said it contacted the users whose records it confirmed had been accessed and notified the 18 agent owners individually. It cautioned users about unsolicited messages that mention account details or balances. Names and email addresses were also among the records exposed in the recent Chainalysis breach, where the company urged customers to watch for unexpected password reset or authentication requests.
The broader Crypto Fear & Greed Index rose to 32 on Tuesday from 29 on Monday, remaining in the Fear range.
Fear & Greed Index
Nov. 10, 2026NEAR AI said it reported the flaw to SGLang’s maintainers and would make any required regulatory notifications. Its disclosure did not identify the attacker, give a public vulnerability identifier or set a date for another update.
Stay up to date
Get the latest crypto insights delivered to your inbox
Primary sources and further reading
| Source | Title |
|---|---|
| | NEAR AI security incident report |
| | NEAR AI Cloud and Private Chat launch |
| | Brave documentation of confidential inference for Leo |
| | SGLang documentation |
Fact-checked by: Daily Crypto Briefs Fact-Check Desk
Related Articles
Frequently Asked Questions
What data was exposed in the NEAR AI breach?
NEAR AI said the attacker downloaded names and email addresses for about 100 users of its former Private Chat service, along with plan and balance information for some accounts. Data from 18 legacy agents was also retrieved, and two NEAR AI Cloud customers had API keys exposed.
Did the NEAR AI breach affect the blockchain or crypto wallets?
NEAR AI said in public updates reported by The Crypto Times that NEAR Protocol was unaffected. As of 13:46 UTC on Nov. 10, 2026, the company had reported no wallet theft or on-chain losses linked to the Cloud breach.
Could the attacker see confidential NEAR AI prompts?
NEAR AI said the attacker could have observed requests as they ran on the compromised server on Nov. 8, including requests in confidential mode. The company did not say how many requests were involved or identify the customers whose requests might have been visible.
Is NEAR AI Cloud back online?
Yes. NEAR AI said it restored Cloud after patching the SGLang vulnerability across its inference servers and replacing credentials. It took Private Chat offline and contacted users and agent owners whose data it confirmed had been accessed.