ARTICLE ORIGINAL MAG212 CYBER

AI Inference Platforms Breached: NEAR AI Hit Through an SGLang RCE, Fireworks AI by an LLMjacking Crew

novembre 11, 2026 · El Mostafa Ouchen

MAG212 CYBER illustration: a neural-network chip connected to inference servers with one red compromised node, headline 'AI inference platforms are now breach targets'.

Two AI infrastructure companies disclosed breaches within days of each other, and together they show how the AI supply chain is being attacked. NEAR AI says an attacker exploited a remote code execution flaw in SGLang, the open-source inference engine on its servers, and reached internal systems, user data and customer API keys. Fireworks AI says an attacker came in through an incident at a third-party cloud provider and ran unauthorised workloads, and attributes it to a financially motivated group reselling stolen AI capacity, a practice known as LLMjacking.

Two lanes of four boxes: NEAR AI from SGLang RCE to exposed users, agents and API keys; Fireworks from a third-party cloud incident to accessed data and LLMjacking attribution.
Figure 7 · Two AI platform breaches, two different routes. NEAR AI was entered through its inference engine; Fireworks through a third-party cloud provider. Neither has published a CVE, fixed version or IOC. Diagram: MAG212 CYBER

NEAR AI: an exploited SGLang flaw, and a TEE that didn’t help

[Confirmed] On 8 November an attacker exploited an RCE in SGLang, “the open-source inference engine running on our servers”, reached NEAR AI infrastructure and an internal system behind the deprecated Private Chat service. Exposed: names and emails of about 100 users (some with plan and balance data), chat history, settings and logs of 18 agents on a legacy deployment outside the TEE, and two Cloud customers’ API keys (now revoked) that sat in logs. No sign stored Private Chat conversations were accessed, but the attacker “could also have observed user requests”, including confidential-mode ones. NEAR AI revoked sessions and admin credentials, took Private Chat offline, patched every inference server, rotated credentials and notified users. (NEAR AI) [Reported] The TEE “does not protect against a vulnerability in the software running inside the environment”. Brave’s Leo uses a NEAR AI-run TEE; NEAR hasn’t said whether the server handled Brave traffic. (Les actualités des hackers)

[Unknown] No CVE, endpoint, SGLang version or IOCs, and no SGLang advisory tied to the incident. CERT/CC listed six unpatched SGLang flaws in July, but nothing links NEAR AI’s breach to any of them. SGLang operators (CERT/CC): keep SGLang off untrusted networks, segment it, set SGLANG_USE_PICKLE_IPC=false (a configuration change; restart the process, MAG212 analysis) and disable unused endpoints. (CERT/CC) [MAG212 analysis] Also require API keys and keep secrets out of inference-host logs.

Fireworks AI: an LLMjacking crew came in through a third-party cloud provider

[Confirmed] An unnamed cloud provider hosting Fireworks R&D machines had an incident on 23 October; on 24 October the attacker reached development machines and ran an unauthorized workload, detected the same day. Accessed: resource metadata, billing and shipping addresses, invoices, balances, secrets for a limited set of accounts and some incomplete model weights and datasets. Not affected: Inference, Training SDK and Nexus; card numbers aren’t stored. Fireworks attributes it to an unnamed, financially motivated group reselling tokens through illicit gateways (LLMjacking), engaged Unit 42 and told law enforcement. (Fireworks) [Reported] Affected accounts are a “limited number”, all notified. The Record reports Notion was notified on 2 November, disconnected, disabled its Insights feature and stopped serving open-weight models via Fireworks. (Le Record) We do not report that Notion AI chats were exposed: a THN headline says so, but neither its article body nor Fireworks’ bulletin does, and we haven’t read Notion’s advisory. (Les actualités des hackers)

Fireworks customers [MAG212 analysis]: rotate secrets stored in Fireworks and all API keys; look for keys you didn’t create and odd usage or billing; treat uploaded datasets and fine-tunes as possibly exposed; alert on LLM usage spikes. Lesson: treat AI vendors as holders of your secrets, with scoped, rotatable keys on your third-party risk register.

Pourquoi c'est important

Organisations increasingly hand AI vendors their prompts, data sets, fine-tunes and API keys, often without the third-party scrutiny they would apply to a payroll or CRM vendor. NEAR AI’s case also shows that a trusted execution environment protects against the host, not against vulnerable software running inside it. Inference engines are young, fast-moving code that is frequently exposed on networks it was never hardened for.

The bottom line

Rotate any secrets and API keys stored with affected AI vendors, alert on unusual model usage and billing, keep inference engines such as SGLang off untrusted networks and out of your logs’ reach for secrets, and add AI providers to your third-party risk register with scoped, rotatable keys.

How we label evidence: [Confirmed] comes from a primary source such as a vendor or CISA; [Reported] from a secondary outlet; [Claimed] from an attacker or an unverified party; [MAG212 analysis] is our judgement; [Unknown] means not established at press time. Commands and indicators are copied from the cited sources and were not tested by MAG212 CYBER.

This story is part of MAG212 CYBER Daily, 11 November 2026, with the day’s other verified stories, the Defender’s Action Desk and a full source register. Get the daily briefing free: subscribe to MAG212 CYBER. Par El Mostafa Ouchen.