AI servers become a way in for attackers after data and keys
Attackers broke into NEAR AI on 8 November through a flaw in SGLang software, while America's CISA reports active attacks on GPUStack, an AI tool.
The machines that run AI models are becoming targets in their own right: through them attackers reach accounts, AI-agent histories and access keys to cloud services. Isolated hardware offers no protection against flaws in the software running on it.
What happened
NEAR AI published an incident report on 9 November. An attacker exploited a remote-code-execution flaw in SGLang, widely used open-source software for running AI models, and moved from one inference server into other internal systems. According to the company, about 100 user accounts were affected, with names, email addresses and in some cases subscription and balance details; so were the chat histories, settings and logs of 18 older AI agents, and the access keys of two cloud customers, since revoked. NEAR AI concedes that hardware isolation does not protect against vulnerabilities in software inside the protected environment. Separately, on 9 November the Cybersecurity and Infrastructure Security Agency (CISA), America's cyber-defence agency, added a GPUStack flaw rated 9.8 out of 10 to its catalogue of actively exploited vulnerabilities. GPUStack manages graphics processors for AI models; according to its maintainers, exploitation can yield administrator rights, persistent access keys and secrets of linked cloud accounts. A fix has been available since July.
What follows
Many firms now run AI models themselves to keep data in-house. That brings a new type of server into the data centre, often set up quickly and seldom maintained as strictly as databases or email. Whoever takes it over gets not only models but the keys to everything AI agents are connected to: cloud accounts, payment services, customer data. Assessment: both cases are small, but they follow the same pattern as last week's stolen AI keys. For banks and insurers running AI servers under supervision, maintaining this software becomes an audit question.
What changes in practice
- IT departments
- Self-hosted AI servers belong in routine patching; access keys stored on them should be rotated regularly.
- Users of AI services
- Incidents are often followed by fake messages about accounts or balances; NEAR AI explicitly warns of this.
- Companies
- Confidential computing environments reduce risk but do not replace maintenance of the software running inside them.
What to watch
- Further AI software entries in CISA's catalogue of exploited flaws
- Warnings from Germany's BSI, the federal cyber-security agency, on self-hosted AI models
- Reports of misused cloud keys taken from AI environments
Sources
- NEAR AI: Security incident report – SGLang vulnerability, 9.11.2026
- Decrypt: Near AI Breach Exposes User Details and Data From 18 AI Agents, 10.11.2026
- Bitcoin.com News: Near AI Confirms Security Breach Affecting 100 Users and 18 Agents, 10.11.2026
- The Hacker News: CISA Warns of Active Exploitation of OpenSSH, GPUStack, FreeSWITCH, and IBM Flaws, 10.11.2026