NEAR AI pauses Cloud inference after reported unauthorized access

NEAR AI said on November 9 that it identified unauthorized access to its internal systems and paused NEAR AI Cloud inference while it investigates. For a provider whose whole pitch is verifiable private inference, the outage is the story: its own status page shows Chat API at 92.59% uptime for the week.

Key facts

• NEAR AI's status post, published November 9 at 23:14 UTC, says the company "recently identified unauthorized access to NEAR AI internal systems" and "paused NEAR AI Cloud inference" as a precaution, with an update promised within two hours.
• The NEAR AI status page shows a "major outage" banner in progress, last updated November 9 at 10:50 PM UTC: Chat API at 92.59% uptime for the November 3–9 window, Agent Servers at 96.35%, individual models between 96.06% and 99.66%.
• The same post says inference "runs inside hardware-isolated secure enclaves (TEEs) to keep customer prompts private" and that NEAR Protocol and other NEAR services were not affected.
• As of the morning of November 10, the NEAR AI blog had no incident post — its latest entry is dated November 4 — and no postmortem or status-page incident entry describing what systems were touched.
• Crypto Briefing reported that by November 10 NEAR AI had confirmed the unauthorized access "addressed and closed," with an investigation still continuing and the cloud service offline until it can be safely brought back. That account is the outlet's reporting on NEAR AI's statements, not an independent audit.

What happened

Everything published so far traces back to the provider. At 23:14 UTC on November 9, NEAR AI's official account posted that it had identified unauthorized access to internal systems and had paused Cloud inference while investigating. The post named the containment logic in the same breath as the incident: inference on NEAR AI Cloud "runs inside hardware-isolated secure enclaves (TEEs) to keep customer prompts private," and NEAR Protocol — the blockchain, a separate surface — "and other NEAR services are not affected." It closed with a promise to "share an update within two hours."

The provider's own status page corroborates the operational impact independently of the X post: a "major outage" banner in progress, last updated November 9 at 10:50 PM UTC, with Chat API at 92.59% uptime over the November 3–9 window and the outage flagged across Private Inference Models, the Cloud API route, and the Attestation endpoint (98.56%). Individual model routes sit between 96.06% and 99.66% for the week. So the pause is real and measurable, even though every characterization of the intrusion itself is still NEAR AI's own.

What NEAR AI has not said is what a security team would normally put in a disclosure: which internal systems were touched, how access was gained, whether any customer data or credentials were exposed, or whether the enclave layer itself saw anything unusual. The company blog had no incident post as of November 10 (its latest entry is from November 4), and the status page banner, while it confirms an outage in progress, carries no incident writeup. Crypto Briefing's coverage — the first trade coverage we located — reports that by November 10 the company had said the access was "addressed and closed," while noting NEAR AI has not described how the access occurred, who was behind it, or what specific systems were touched beyond calling them internal.

One same-window data point adds useful context, though it is commentary, not mitigation: a practitioner audit thread posted in the hours before the disclosure found that open models on NEAR AI Cloud returned Intel TDX and GPU-level attestations while closed models returned none. That is the verification machinery working as designed on the prompt path — but an attestation proves what ran inside the enclave, not that the operator's control plane is sound. Both things are true at once, and this incident lives in the gap between them.

Why it matters

This stress-tests the beat's core thesis with a live case. NEAR AI Cloud sells confidential inference: your prompt runs inside a hardware enclave so the operator cannot read it, and you can verify the enclave's attestation yourself — a model we covered in our guide to confidential AI inference with TEEs and in our earlier profile of NEAR AI Cloud's TEE offering. If a provider in that category can have its internal systems breached, builders learn something the marketing never states plainly: hardware isolation protects the prompt path, but it does not protect the operator plane. A compromised operator can still take your workload offline, misroute it, or fail to restore it promptly.

That makes availability a first-class variable in the private-inference decision, equal to confidentiality. A workload that only accepts enclave-signed verdicts — like the developer on X who runs three AI judges on NEAR AI Cloud and paused new rulings along with the platform — can keep integrity while losing uptime. Builders should price that trade in advance: what happens to your agent loop when your private-inference provider pauses for a day?

There is also a disclosure-discipline question worth naming without overreaching. The company disclosed on X first, promised an update within two hours, and as of this writing has no durable status-page incident entry or blog post. X is a bad system of record for security disclosures: posts are hard to cite, easy to lose, and invisible to anyone doing due diligence a month from now. Providers in this market — where the entire product is trust — have an incentive to publish postmortems builders can link. This one has not yet.

Background

NEAR AI Cloud routes open-weight models — including GLM 5.3 Flash and DeepSeek V4.1 Flash — through Intel TDX enclaves, paired with Intel Trust Authority attestation so customers can verify what ran independently of the operator. We have covered this architecture repeatedly: how confidential inference with TEEs works, how the provider positions verifiable private inference, and how abliterated open models on hosted TEE APIs extend the same pattern to uncensored workloads. The company doubled down on the security niche just eleven days ago, launching NEAR AI Red for security teams on October 29.

Hardware vendors have been making the same argument from the silicon side: NVIDIA's confidential computing on Blackwell and now hyperscaler TEE programs all pitch the claim that data stays encrypted through processing. The category's implicit promise has always been that the enclave boundary removes the operator from the trust base. What this incident shows — pending NEAR AI's own postmortem — is that the boundary was never supposed to promise uptime or operator-plane integrity, only prompt confidentiality. Those are different guarantees, and buyers who conflated them are now learning the difference through a status page.

What's next

Three things would move this story from claim to record. First, a durable incident entry on the NEAR AI status page or a blog post with scope: what systems, what access, what exposure. Second, a postmortem with a timeline and remediation, the standard for providers selling trust. Third, independent verification of the enclave layer's behavior during the incident window — attestation logs would show whether enclave integrity was ever in question. NEAR AI said the update would come within two hours of the November 9 post; the missing document is now the story. We will update this article when the provider publishes scope or a postmortem, and treat every claim above as NEAR AI's own until then.