SGLang RCE Exploit Breaches NEAR AI: How Data Was Stolen From 18 Agents

The rapid integration of Large Language Models (LLMs) into critical infrastructure has brought unprecedented advancements in artificial intelligence capabilities. However, this technological acceleration has cast a long shadow over the domain of AI security. Recent incidents have starkly illuminated that capability does not equate to inherent safety. One particularly alarming event involved the exploitation of a vulnerability within SGLang, leading to a significant breach at NEAR AI. This incident serves as a potent, real-world case study demonstrating the critical risks associated with unchecked LLM deployments and underdeveloped security protocols.

The attack vector—an SGLang Remote Code Execution (RCE) flaw—allowed malicious actors to bypass standard application defenses and gain unauthorized access to sensitive operational data. The fallout was severe: data belonging to eighteen distinct AI agents was compromised, raising urgent questions about the robustness of current guardrails protecting enterprise-level AI deployments. This article will dissect the technical mechanics behind this breach, detailing precisely how an LLM vulnerability translated into a catastrophic data theft event for NEAR AI and what these findings mean for the entire industry.

Understanding the Vulnerability: The Core of the SGLang RCE Exploit

At its heart, the incident revolved around an insecure handling mechanism within the SGLang framework. Remote Code Execution (RCE) represents one of the most severe classes of software vulnerabilities because it grants an attacker the ability to execute arbitrary system commands on the vulnerable host machine. In the context of LLMs, these exploits often arise when user-supplied input—or data processed through the model's pipeline—is inadequately sanitized before being passed to underlying operating system functions or internal libraries. The SGLang vulnerability specifically exploited a deserialization or command injection pathway, allowing carefully crafted inputs to trick the application into executing unintended backend code.

Technically speaking, an RCE exploit typically requires chaining together several weaknesses. In this case, the flaw allowed attackers to manipulate parameters that were supposed to govern model interaction but instead provided hooks into the system's shell environment. An attacker wouldn't just prompt the LLM with malicious text; they would craft a payload that, when processed by SGLang’s backend logic, misinterpreted harmless input as executable code. This highlights a crucial distinction: the vulnerability wasn't necessarily in the *intelligence* of the model itself, but rather in the *scaffolding*—the surrounding software layers responsible for managing and serving that intelligence securely.

The Mechanism of Code Execution

The exploit chain leveraged poor input validation. If a system expects string inputs (e.g., "Analyze this document") but fails to validate that these strings do not contain shell metacharacters (such as semicolons, backticks, or pipe symbols), an attacker can inject commands like ; cat /etc/passwd. When the vulnerable function executes the combined string via a system call (like system() in C/C++), the operating system treats the entire sequence as distinct commands, executing both the intended logic and the malicious payload.

The Breach Mechanism: How Attackers Leveraged the Flaw Against NEAR AI

NEAR AI was utilizing SGLang to manage and interact with a suite of specialized AI agents. These agents were designed for complex tasks, requiring access to various internal data sources—a necessary component for advanced functionality but also the primary security liability. The attackers didn't just exploit SGLang in isolation; they weaponized it against the established trust boundaries between the LLM service and the connected agent databases.

The initial foothold gained via RCE allowed the threat actor to operate with the permissions of the web service itself. From this vantage point, lateral movement was relatively straightforward. They bypassed authentication layers because their commands were executed *after* authentication checks had already passed for the SGLang API endpoint. The goal shifted from merely proving a vulnerability existed to achieving persistent data exfiltration.

Targeting Inter-Agent Communication

The eighteen compromised agents represented different functional silos within NEAR AI's ecosystem—some handling financial modeling, others managing user profiles, and others dealing with proprietary research data. By executing commands on the underlying server infrastructure, the attackers were able to query the databases connected to these agents sequentially or simultaneously, effectively treating the entire interconnected system as a single, vulnerable target.

Impact Assessment: Analyzing the Data Stolen From 18 Agents

The sheer scale of the data theft underscores the severity of this LLM vulnerability. The compromised data was not uniform; it represented a mosaic of highly sensitive corporate assets. This required forensic analysis to categorize, but preliminary findings point toward a mixture of Personally Identifiable Information (PII), proprietary algorithmic weights, and confidential project roadmaps.

The compromise of eighteen agents signifies that the security failure was systemic, affecting multiple distinct operational boundaries rather than being limited to one single data repository. This necessitates a complete re-evaluation of how LLM applications are architected in enterprise settings. The lessons learned from this NEAR AI breach center on strict input sanitization, capability isolation (containerization), and adopting Zero Trust principles even within the application's own service layer.

NEAR AI's Response and Immediate Containment Measures

Upon detection of the SGLang RCE vulnerability exploitation, NEAR AI initiated a multi-phased incident response plan designed to minimize data loss and restore operational integrity. The immediate focus was on containment, forensic preservation, and service restoration.

Incident Triage and Isolation

The first action taken was the rapid identification and isolation of potentially compromised segments within the agent orchestration layer. This involved:

• Network Segmentation: Applying emergency firewall rules to restrict all outbound network traffic from the affected microservices, allowing only essential monitoring and communication channels to remain active.
• Service Quarantining: Taking the primary API endpoints associated with the vulnerable component offline (read-only mode) while maintaining basic uptime for status checking. This prevented further external exploitation attempts through the known vector.

Forensic Data Preservation

To understand the scope of the breach, forensic imaging was paramount. The team focused on preserving volatile data sources:

• Logging Aggregation: All logs from the container orchestration platform (Kubernetes audit logs, application access logs) were immediately streamed to an immutable, write-once storage bucket (e.g., S3 Object Lock). This ensured that attackers could not tamper with evidence of their activity.
• Memory Dumps: For critical services suspected of hosting the exploit payload, memory dumps were captured using tools like volatility before any system reboot or service restart. This is crucial for identifying in-memory artifacts left by the attacker.

Credential Rotation and Remediation

Given that RCE exploits often aim to steal credentials, a comprehensive credential rotation was executed across the entire infrastructure:

# Example command sequence for critical secret rotation
kubectl scale deployment --replicas=0 agent-controller >&--namespace=production
vault write secret/data/api_keys/sglang_access generate=<new_key>&ttl=24h
# Update configuration maps referencing the old keys immediately
helm upgrade --install agent-config ./chart -n production --set apiKeys.sglang=new_key:$(vault read secret/data/api_keys/sglang_access value)

All service accounts, API keys, and database credentials utilized by the affected services were rotated simultaneously across all environments (Staging, Production, Development).

Industry Implications: Securing LLM Infrastructure Against RCE Threats

The NEAR AI incident serves as a stark warning to the entire industry deploying sophisticated Large Language Model (LLM) agents. The attack vector—exploiting underlying framework vulnerabilities like SGLang—highlights that model security is insufficient; the surrounding infrastructure and orchestration layers are equally, if not more, vulnerable.

Shifting Focus from Prompt Injection to Runtime Security

The industry must move beyond solely focusing on prompt injection defenses (which guard the input/output dialogue) and adopt robust runtime application self-protection (RASP) mechanisms for the entire LLM pipeline.

• Principle of Least Privilege (PoLP) at Container Level: Agents should never run with elevated privileges. If an agent only needs to read from a specific database, its container profile must be explicitly limited to only those necessary network ports and filesystem paths.
• Input Validation Depth: While prompt validation is common, infrastructure input validation (e.g., validating parameters passed to internal SDK calls) must treat all external inputs as hostile code, not just text prompts.

Supply Chain Risk Management for ML Frameworks

RCE exploits often target underlying dependencies. Organizations must implement rigorous Software Composition Analysis (SCA) that goes beyond simple dependency listing.

# Best Practice: Automated Dependency Scanning Pipeline Check
sca_tool check --project=agent_orchestrator --severity>=HIGH --fail-on-vulnerability
# Incorporate vulnerability feeds directly into CI/CD gates.

Furthermore, adopting verifiable build environments (e.g., reproducible builds using tools like Bazel) ensures that the deployed artifact exactly matches the vetted source code.

Preventative Strategies: Hardening Systems Post-Exploit Analysis

Based on the lessons learned from the SGLang breach, NEAR AI is implementing several permanent architectural and operational hardening measures to build resilience against similar attacks.

Runtime Sandboxing and Execution Context Control

The most critical technical mitigation is enforcing strict execution boundaries for all user-facing components:

• Use WebAssembly (Wasm) Sandboxes: For executing arbitrary code or calling external tools invoked by an LLM agent, Wasm runtimes offer significantly stronger memory and capability isolation than traditional Docker containers alone. Each agent workflow should be containerized within a dedicated, minimal Wasm sandbox.
• System Call Filtering (Seccomp): Implementing strict Seccomp profiles ensures that even if the process is compromised, it cannot execute system calls unrelated to its core function (e.g., blocking raw socket creation or filesystem write access outside designated directories).

Implementing Zero Trust Architecture for Agents

Every interaction—whether agent-to-agent or agent-to-database—must be authenticated and authorized, regardless of prior network placement.

1. Mutual TLS (mTLS): All inter-service communication within the agent mesh must use mTLS. This guarantees that both the client and server cryptographically verify each other's identity before any data exchange occurs.
2. API Gateway Authorization: Utilize an API gateway configured to enforce granular role-based access control (RBAC) based on the calling service identity, not just an API key.

Automated Vulnerability Patching and Drift Detection

To minimize the window between patch release and deployment:

• Immutable Infrastructure: Treat all deployed components as disposable. Instead of patching a running server (which risks configuration drift), build a completely new, patched container image and redeploy it entirely via rolling updates.
• Runtime Drift Detection: Implement monitoring that compares the current state of critical system files or binaries against a known-good cryptographic hash stored in a secure vault. Any mismatch triggers an immediate alert and automated rollback.

Frequently Asked Questions (FAQ)

Conclusion and Key Takeaways

The breach of NEAR AI due to the SGLang RCE exploit serves as a stark and urgent reminder of the rapidly evolving threat landscape surrounding advanced AI infrastructure. This incident highlights critical vulnerabilities that can exist even within seemingly robust, modern systems. The successful exploitation underscores several key takeaways for any organization integrating cutting-edge AI models:

First, dependency on third-party libraries and frameworks must be rigorously vetted for known vulnerabilities like deserialization flaws or insecure input handling. Second, the principle of least privilege must extend deep into the application stack, ensuring that a compromise in one component cannot lead to the exfiltration of data from unrelated agents.

The theft of data from 18 distinct agents demonstrates that an attacker's goal is often comprehensive lateral movement once initial access is gained. AI-native systems require specialized security architectures that treat model endpoints, underlying data stores, and operational APIs as equally sensitive attack surfaces.

Proactive Defense: Partnering with hSECURITIES

Do not wait for a breach to identify systemic weaknesses. The sophistication demonstrated by the SGLang attack requires an equally sophisticated defensive posture. At hSECURITIES, we specialize in securing complex, interconnected technological stacks, including those powered by Generative AI and Machine Learning pipelines. We offer comprehensive technical advisory services, deep-dive penetration testing focused on LLM vulnerabilities, and full security architecture audits.

If your organization handles sensitive data or deploys mission-critical AI agents, we urge you to take immediate action. Contact our expert team today to schedule a confidential consultation. Let us help fortify your digital perimeter against the next wave of sophisticated cyber threats, ensuring your innovation remains secure.