Railway Details October Breach: Stolen AI API Keys and Roughly $740,000 in Fraudulent Usage

AI provider API keys have become prime targets in their own right. Application hosting platform Railway published its full report on Tuesday, November 10, regarding the breach it suffered on October 20 and 21. According to the company, the attacker was primarily looking for AI keys that customers store within their environment variables. The stolen keys were used to rack up roughly $740,000 in unauthorized consumption.

A Chain of Flaws

The report outlines a multi-stage lateral attack. On October 20, the threat actor exploited an unknown vulnerability in Railway’s build infrastructure—which was shared among multiple customers on a single machine—to partially escape container isolation and read host files. From there, they extracted a build credential intended solely for pushing container images, but which an internal task orchestration system (Temporal) accepted as a trusted client. This allowed the attacker to view the history of 353 builds, including variables, and obtain a copy of Railway’s internal code repository.

This source code enabled them to hunt for additional entry points. During the night of October 21, they found an OIDC misconfiguration in the deployment pipeline, acquired temporary cloud credentials, and connected to an orchestration host storing a key capable of decrypting customer variables. Database query logs reveal that the attacker systematically filtered for variable names matching AI provider keys, specifically targeting customers who held high volumes of secrets. Railway states that it evicted the attacker from its systems on the morning of October 21.

Scope of the Impact

At most 1.85% of workspaces, or approximately 100,000, may have had variables decrypted. Railway emphasizes that this represents an upper bound, as access logs identify environment scopes rather than specific individual variables. Account-linked tokens (BYOK agent keys, GitHub OAuth tokens) belonging to 1,852 users were also decrypted; all have been reset, and no unauthorized logins to Railway were observed. During the incident, the hosting provider coordinated with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, and Stripe to revoke potentially compromised keys.

Who covers the roughly $740,000 bill? That depends on the vendor. AWS Bedrock and Google are issuing refunds under their fraud policies, while OpenAI and SpaceXSI are reviewing claims on a case-by-case basis. Railway is stepping in to cover charges tied to Anthropic while discussions continue, as well as OpenRouter, which is sticking to its strict no-refund policy.

What Railway Suspects but Cannot Prove

Railway suspects the stolen keys were funneled into proxy services that resell access to models, particularly for distillation—training one model using the outputs of another. Fraudulent activity observed ranged from autonomous coding agents to full training pipelines. The report also asserts that the attacker relied on jailbroken models stripped of guardrails. Finally, Railway points to a broader wave of attacks targeting platforms storing AI credentials, citing similar credential thefts at OpenCode, Warp, and Fireworks AI between October 6 and October 23, though no definitive link ties them to the same actor.