The Confidential Computing Fallacy: How an SGLang RCE Pierced NEAR AI's Hardware Enclave and Exposed Agent Workloads
An unpatched remote code execution flaw in the SGLang inference engine compromised NEAR AI's confidential computing nodes, demonstrating that hardware-attested TEE boundaries offer zero protection against application-layer exploits.
Published: 2026.11.11
Payload executed directly inside confidential runtime
Chat logs, configs, and 2 live cloud API keys leaked
Fleet-wide binary replacement and session purge
Hardware-enforced Trusted Execution Environments (TEEs) guarantee memory encryption against untrusted hypervisors, cloud operators, and co-tenant workloads. They do not, however, validate the memory safety or logic hygiene of the application binaries executed within the enclave boundary.
A critical remote code execution (RCE) vulnerability in SGLang, a high-throughput open-source inference engine, allowed an external attacker to execute arbitrary shell commands inside NEAR AI’s confidential inference cluster. Because SGLang served as the primary entry point inside the enclave, the attacker intercepted unencrypted inference requests in memory before traversing laterally into legacy internal infrastructure.
Anatomy of the lateral pivot across confidential and unshielded enterprise tiers
Malicious request hits unpatched SGLang engine over standard API endpoints.
RCE triggers inside the TEE, bypassing hardware-level hypervisor attestation.
Active inference payloads and confidential session buffers read directly from memory.
Attacker pivots out of the GPU node to access deprecated Private Chat databases.
Extraction of 18 agent configs, prompt histories, and 2 plaintext API keys from legacy hosts.
The Enclave Fallacy: Application RCE Defeats Hardware Confidentiality
Confidential AI computing relies heavily on technologies like AMD SEV-SNP and Intel TDX to insulate guest operating systems from malicious infrastructure providers. Enterprise teams frequently conflate hardware attestation with total data immunity. When an inference runtime exposes an unauthenticated remote execution vector, the boundary established by the secure enclave becomes irrelevant.
In the NEAR AI incident, the compromised server operated under a “confidential mode” intended to make inference payloads inaccessible even to platform operators. Because SGLang executed the untrusted input directly inside the encrypted boundary, the attacker obtained the enclave’s native execution privileges.
Hardware attestation guarantees only that the designated binary is running inside an untampered container. If that binary contains an RCE vulnerability, the attacker inherits full administrative access to decrypted memory buffers.
The exploit allowed the threat actor to snoop all active inference jobs routed through the compromised host on that date. High-profile consumer integrations—including Brave Software’s Leo assistant, which routes GLM 5.3 Flash inference through NEAR AI’s confidential infrastructure—highlight the supply-chain exposure introduced when enterprise applications outsource zero-knowledge processing to third-party inference tiers.
Threat Vector Architecture and Infrastructure Exposure Metrics
The post-exploitation phase revealed substantial configuration debt across NEAR AI’s supporting infrastructure. After obtaining execution access on the inference host, the attacker discovered accessible network routes into legacy internal clusters rather than encountering hardened microsegmentation.
Structural divergence between hardware isolation and application security
- • Memory encryption defends against physical RAM sniffing and malicious hosts
- • Hypervisor is cryptographically locked out of guest execution space
- • Remote attestation verifies binary image integrity at initial boot
- • Unsanitized deserialization or buffer overflows yield in-enclave root shells
- • Payload data rests unencrypted in working memory during model execution
- • Egress sockets permit pivoting if host networking lacks microsegmentation
The pivot compromised two critical secondary targets: a deprecated “Private Chat” database and an older orchestration deployment hosting 18 non-TEE AI agents. While core encrypted chat transcripts remained intact, the attacker harvested metadata for approximately 100 accounts, complete agent system settings, and two enterprise API credentials logged in plaintext.
| Infrastructure Tier | Security Architecture | Observed Attack Vector | Compromised Data Assets | Remediation Cost / Friction |
|---|---|---|---|---|
| Active Inference Node | Hardware TEE (Confidential Mode) | SGLang unauthenticated RCE | In-flight prompt memory & session tokens | Node tear-down; binary patch deployment |
| Private Chat Backend | Deprecated internal microservice | Lateral pivot over unsegmented LAN | ~100 user emails, plan balances, billing tiers | Service decommission; session invalidation |
| Legacy Agent Cluster | Standard VM (Non-confidential) | Shared infrastructure credentials | 18 agent configs, chat histories, execution logs | Environment rebuild; full secret rotation |
| Production API Layer | Global Gateway & IAM | Plaintext key leak via debug logs | 2 enterprise NEAR AI Cloud API keys | Immediate token revocation; client outreach |
Operational Lessons in Deprecated Systems and Plaintext Secret Exposure
The lateral expansion of this breach underscores two persistent anti-patterns in enterprise AI engineering: the survival of deprecated shadow services and the logging of raw API keys in agent telemetry databases.
Legacy microservices represent an asymmetrical threat surface. The Private Chat service remained accessible across internal routing tables long after active engineering maintenance ceased. Because deprecation protocols did not mandate complete decommissioning, network isolation, or data purging, an attacker pivoting out of an edge inference node found an immediate unmonitored path to user account metadata.
Quantifying credential and record exposure across internal asset categories
Simultaneously, the exfiltration of credentials from the legacy agent cluster illustrates the danger of uncontrolled log ingestion. LLM orchestration frameworks frequently capture complete runtime states—including HTTP authorization headers and environment parameters—to support tracing and reproducibility. When debug logs record client API keys directly into agent datastores, any downstream infrastructure breach automatically escalates into an API supply-chain compromise.
Engineering Mandates for Hardening High-Throughput Inference Workloads
Organizations deploying self-hosted inference engines (e.g., SGLang, vLLM, TensorRT-LLM) inside or outside confidential enclaves must re-evaluate their defense-in-depth posture. Hardware boundaries must never serve as the sole isolation layer.
Three structural interventions to prevent runtime escape and lateral pivoting
Run inference runtimes under locked-down seccomp filters and non-root users inside TEE containers.
Block all outbound network calls from GPU inference nodes except for strict mutual-TLS model registries.
Deploy regex scrubbing on tracing pipelines to prevent authorization tokens from reaching agent state logs.
1. Enforce Internal Container Sandboxing Inside TEE Guests
Do not execute inference runtimes with root privileges inside the confidential guest OS. Wrap inference engines in unprivileged user namespaces governed by aggressive seccomp profiles, read-only root filesystems, and strict memory limits. If the runtime experiences an RCE exploit, the shell environment remains confined to an ephemeral memory layer with no system-level pivoting utilities.
2. Implement Unidirectional Network Egress Controls
Inference worker nodes require ingress connectivity to receive requests and dispatch tokens. They rarely require arbitrary outbound access to internal subnets. Restrict worker node egress using strict network security policies (e.g., Calico, Cilium). Nodes handling model inference must be cryptographically prevented from establishing connections to corporate databases, internal identity providers, or legacy staging environments.
3. Automate Ephemeral Secret Rotation and Deprecation Enforcement
Sanitize observability pipelines to prevent API authorization headers from entering persistent operational logs. Implement automated scanners to detect and scrub API token patterns before state data commits to agent memory stores. Finally, treat service deprecation as an operational vulnerability: when a product tier reaches end-of-life, tear down its underlying virtual networks, purge databases, and revoke routing table entries within 30 days.