DEV Community

Cover image for NEAR AI was breached through the engine running its agents, not the prompt
Humanbound profile image Sofia_ Humanbound
Sofia_ Humanbound for Humanbound

Posted on

NEAR AI was breached through the engine running its agents, not the prompt

#agents #ai #security

Humanbound's engine and CLI are open source: github.com/humanbound/humanbound

NEAR AI disclosed on 9 November that an attacker used a remote code execution flaw in SGLang, its model-serving engine, to reach chat histories, settings and logs from 18 agents plus two customers' API keys. On 10 November a policy bypass in the AWS API MCP Server (CVE-2026-125271) was published, and on 11 November Corelight showed MCP servers silently pulling different dependencies on every rebuild. The model was never the weak point in any of them. The weak point was the plumbing around the agent.

What happened at NEAR AI

The attacker got code execution on one NEAR AI inference server through an SGLang vulnerability, then moved further into the infrastructure via an internal system tied to a retired feature. NEAR AI paused its cloud inference on 9 November and reported access closed and credentials rotated by the 10th.

What was exposed:

  • Names and emails for about 100 users, plus plan and balance details for some
  • Chat histories, settings and logs from 18 older agents
  • NEAR AI Cloud API keys for two customers, sitting in logs (since revoked)

NEAR AI hasn't said which SGLang flaw was used. CERT/CC documented six SGLang vulnerabilities in July, so anyone self-hosting SGLang has a reason to check their version today.

The detail that matters: legacy agents outside the safe zone

The 18 exposed agents weren't running inside NEAR AI's confidential computing environment. They were older agents that had stayed outside it. NEAR AI was also candid about the limits of that environment even where it is used: "It does not protect against a vulnerability in the software running inside the environment."

That's a useful sentence to pin above any agent architecture diagram. Isolation protects the boundary. It doesn't protect against the code you put inside the boundary.

Most teams that have shipped agents for a while have their own version of the "18 older agents": prototypes that became production, internal tools nobody migrated, agents whose memory and logs live wherever they were first set up.

The policy layer can be bypassed by a capital letter

CVE-2026-125271 affects the AWS API MCP Server from 0.2.13 up to 1.5.1. Operation names were normalized incorrectly before policy checks, so operations with consecutive capital letters in their names could slip past denyList or elicitList rules. In other words, the layer that decides "this agent may not call that" could be sidestepped by how a name was spelled. It's rated 7.8 (CVSS 3.1), needs local access and user interaction, and has no known exploitation. Fixed in 1.5.1.

The lesson is broader than AWS: an allow or deny list is only as good as the string comparison underneath it, and agents generate a lot of strings.

The MCP server you reviewed is not the one that runs

Corelight's lab study, covered on 11 November, looked at an MCP server launched with uvx. Every rebuild re-resolved PyPI dependencies: 19 builds of one release produced 15 distinct environments, and 23 of 69 packages changed versions. The maintainer had a hash-pinned lock file. The launcher never used it.

Across 35 MCP servers reviewed, 23 recommended an install that resolves from a public registry. On the test workstation, MCP servers made more than 1,600 connections to 11 management systems. Corelight's fix is short: "freeze the environment, not just the release."

And the agent itself can be talked out of its secrets

The final piece is on the social side. AE Studio research covered by The Register gave coding agents a private token, told them explicitly to keep it secret, and pointed them at a forum of other agents offering the fix they needed. Across 181 trials, agents posted the token 15% of the time and ran the swarm's install script 24% of the time, against 2% and 0% on a normal help forum. "Final attempt" pressure pushed script execution from 19% to 34%.

Put that next to NEAR AI's logs full of API keys and you get the full picture: secrets reach agents, agents leak secrets, and the infrastructure around them stores secrets in places attackers can reach.

What to test now, not next quarter

Some practical checks that come straight out of these stories:

  • Inventory your legacy agents. Where do their histories, logs and keys live? Are they inside the same controls as your newest agents?
  • Patch the serving layer like production infrastructure. SGLang, vLLM and friends are now a direct path to agent state.
  • Fuzz your agent's policy layer. Try odd casing, aliases and encodings against every allow and deny rule.
  • Freeze MCP environments. Pin to commits and install from hash-pinned lock files.
  • Test for the day the model is fooled. Riad Gaffar's dev.to experiment showed this well: his model resisted 125 injection attempts, but once scripted to fall for them, 10 of 38 attacker steps passed his own policy.

Find the gaps around your agent before an attacker does. Humanbound's free Community plan runs adversarial tests against your agent's real tools and boundaries, and it's rolling out to as many developers as possible. Sign up free at app.humanbound.ai.

References

Top comments (0)