NEAR AI Revoked 2 API Keys After an SGLang RCE. The 18 Agents Matter More.

I read a lot of incident reports, and most of them are written to say as little as humanly possible. NEAR AI's November 9 disclosure isn't one of those. Not because the news is good. Because the wording is weirdly precise about what the team knows and what it can't rule out.

Here's the short version. A remote-code-execution vulnerability in SGLang, the open-source stack a lot of teams use to serve language models, hit legacy deployment environments at NEAR AI. Roughly 100 user details and 18 agents sat inside the affected context. Two Cloud API keys were exposed and both were revoked.

The team says it found no evidence that stored Private Chat content was compromised. It also warned that some requests made on November 8 could potentially have been observed.

Those two sentences sound like they fight each other. They don't.

Where the flaw actually lived

Let me break this down, because the layering matters and most coverage will skip it.

An AI product isn't one thing. It's a model server, a request router, an auth layer, logging, and the user-facing app, all stitched together. SGLang sits down at the serving layer, the part that turns your prompt into tokens. When something breaks there, an attacker gets a foothold before a user ever touches a wallet or signs anything.

Remote code execution is the nasty category. It means someone can run their own instructions inside your environment. How bad that gets depends on three things: what privileges the process holds, what network access it has, and which secrets are mounted nearby. Two exposed Cloud API keys tells you the answer to that third question wasn't "none."

Here's what matters: the word "legacy." That's the most damning detail in the whole report, and it's buried. Legacy deployment means older infrastructure that didn't get the patch, or didn't get it fast enough. That's not a sophisticated nation-state attack. That's patch hygiene. The reality is most AI infrastructure failures in 2025 will trace back to someone's forgotten staging box, not a genius adversary.

And check the counts. Around 100 user details. 18 agents. Two keys.

Every headline will lead with the 100. Wrong call. The 18 agents are the real number, because agents don't just hold data, they hold credentials and they act on their own. An agent with a live key and network access is a standing permission slip. A user's chat history is a snapshot. An agent is a loaded weapon sitting on a shelf.

So ask the obvious question. How many of those 18 were still holding valid credentials after the fix went in?

This is everyone's problem, not NEAR's

Crypto firms are stuffing AI into dev workflows, customer support, trading research, and ops. That's not a knock. It's just what's happening. The trouble is that the same teams who can quote you their smart contract audit schedule to the day often can't tell you which services have production keys mounted.

From a risk perspective, that's the mismatch nobody's pricing. A well-audited ledger can't compensate for an app server that leaks. The NYSE's tokenized-securities venue plans, the transfer-agent filings, the whole institutional buildout, none of it survives contact with a compromised request router. Institutions underwrite operational risk before they underwrite anything else. Ether ETFs have been bleeding, roughly $201.9 million out the door in a recent stretch, and while that's a flows story, fund boards read incidents like this one and add a line to the due diligence checklist.

The exposure here's infrastructure, not consensus. Let me be clear on that, because the lazy take will be "NEAR got hacked." NEAR AI's serving stack had a flaw. That's not a break in the blockchain's consensus rules and it's not a compromise of ordinary NEAR wallet keys. Conflating the two is how you end up making bad decisions with real money.

But the crypto-plus-AI overlap cuts deeper than one report. AI tools touch private business information constantly, even when they can't sign a transaction. Every one of those touchpoints is a credential. Every credential is a liability with a countdown timer on it.

What the street is missing: the security budget conversation is about to flip. For a decade, crypto teams spent on contract audits and called it done. The next wave of spend goes to service isolation, key rotation, and access monitoring. Boring stuff. Stuff that doesn't demo well at a conference. It's also the stuff that actually keeps you out of a headline.

What I'd do with this

First, give NEAR AI some credit. Publishing counts and admitting that some November 8 requests might have been observed is more candor than most teams manage. A lot of firms would've sat on this until a researcher forced their hand.

Second, don't get comfortable with the phrase "no evidence." That's a statement about logs, not about reality. If the logging was thin or the retention window was short, absence of evidence is just absence of logs. Frankly, "no evidence" is a lawyer's construction wearing a security engineer's jacket.

So here's my hot take. Any firm running agent infrastructure should be required to publish three things within 72 hours of an incident: affected version numbers, root cause, and a validation method for the fix. Not a blog post with reassuring adjectives. A technical postmortem that another engineer can check. NEAR AI has done step one. The follow-up postmortem is where trust actually gets earned, and until it lands the report is a promise, not a proof.

Third, if you used credentials anywhere near these services, rotate them. Not next week. Now. Review permissions on anything an agent could reach. And don't panic about your wallet keys, because those weren't the target.

The boring conclusion is the right one. In a market where everyone's obsessing over positioning and flows and the next narrative, the thing that quietly blows up a portfolio is an unrotated API key on a server nobody remembered was running. The numbers tell the story, and this time the number is 18.