Railway breach: attackers ran up $740K on stolen AI keys

Attackers want your AI keys more than your data.

Railway, the app hosting platform, published its incident report on Tuesday for an attack on Oct. 20 and 21. It says the attacker's queries prioritized AI provider keys.

What Railway says happened

Railway says the attacker began probing its build infrastructure at 06:50 UTC on Oct. 20 and used a previously unknown vulnerability to partially escape filesystem isolation.

A second path ran through what Railway calls "an erroneously defined OIDC binding configuration" in one of its cloud environments. That gave the attacker cloud credentials, and from there access to the database storing encrypted variables.

Between 04:42 and 07:15 UTC on Oct. 21, the attacker decrypted some of those variables. Railway says it evicted the attacker at about 09:25 UTC that day.

The scope, in Railway's words, is "at most, 1.85% (~100,000) of workspaces." Railway calls that an upper bound.

It also says the stored histories of 353 builds were read, and linked-account tokens for 1,852 users were exposed, including agent keys users brought themselves and GitHub OAuth tokens. Railway reset those and says it found no logins to Railway accounts using credentials taken in the incident.

Railway says forensics did not indicate customer databases were accessed.

The keys were the target

Railway says AI provider keys were the primary target, likely for resale and distillation.

The bill so far:

About $740,000 in unauthorized spend on the stolen keys, by Railway's estimate.

Railway says it asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke potentially compromised keys.

Refunds depend on the provider. Railway says AWS Bedrock and Google Gemini account teams have started refunds under existing fraud policies, OpenAI and SpaceXSI are reviewing cases one by one, talks with Anthropic are ongoing, and OpenRouter is enforcing its no-refund policy. Railway says it will cover losses where providers will not.

This is the second such report in two days. Fireworks AI said this week that a group reselling stolen model access, the practice known as LLMjacking, was behind its breach, as TopFive reported yesterday.

An AI API key is now a prepaid card that anyone can spend.

What to do today

If you deploy on Railway, open every AI provider dashboard and look at usage since Oct. 20. Report charges you do not recognize through the form in Railway's post.

Rotate any AI key that lived in a Railway variable, even if your bill looks clean.

Wherever you host, set a monthly spend cap or alert on every AI key, and give each key one project so a single leak cannot drain everything.

Railway says builds now run in a dedicated short-lived virtual machine per build, that it rotated all credentials and secrets, and that secret decryption is now centrally audit-logged.

What to watch

Watch whether Anthropic settles on refunds, and whether OpenRouter holds its no-refund line. Those answers decide who pays for the next breach, the host or you.

Cap your keys tonight. Then check the bill.