Cybersecurity researchers have uncovered a significant vulnerability in the SGLang programming language, which allows attackers to remotely execute malicious code on systems running near AI (Neural Execution Agent) software. The exploit, dubbed SGLang RCE, has already breached 18 agents and compromised around 100 users’ data.
The SGLang vulnerability arises from an issue with how the programming language handles function calls within its interpreter. Specifically, a flaw in the way SGLang resolves function names allows attackers to inject malicious code that is executed by the interpreter as if it were legitimate function calls. This enables the attacker to gain unauthorized access to system resources and escalate privileges.
The researchers found that this vulnerability can be exploited through cross-domain privilege escalation (CDPE), where an attacker with lower-level privileges on a network can exploit vulnerabilities in another domain or zone, effectively bypassing security controls. In this case, attackers can use the SGLang RCE exploit to gain access to sensitive areas of the system and steal data from users.
The compromised agents running near AI software appear to be part of a larger infrastructure, with the researchers suggesting that this vulnerability could have far-reaching consequences if left unpatched. The fact that user data has already been stolen suggests that attackers are actively exploiting this weakness.
Researchers emphasized the importance of remediating this vulnerability quickly, not just for near AI agents but also for any system using SGLang. This is particularly pressing given the potential impact on sensitive data and the ease with which the exploit can be used for privilege escalation.
The incident serves as a stark reminder that even well-designed software systems are not immune to vulnerabilities, especially when interacting with other components or networks. As systems become increasingly complex and interconnected, identifying and addressing such weaknesses is crucial to preventing further breaches.
To protect yourself from similar attacks, it’s essential to keep your system up-to-date with the latest patches and ensure you’re using reputable security software that monitors for potential exploits like SGLang RCE. Additionally, being vigilant about network access controls and user privileges can help prevent unauthorized lateral movement within a compromised system.
Source: The Hacker News — 2026-11-10