Railway Hack Stole AI Keys From Up to 100,000 Workspaces
Railway says its October hack exposed secrets in up to 100,000 workspaces and ran up about $740,000 in stolen AI usage. Here is what happened and what to do.
Hakkı ALKANPublished 6 min read
The Railway hack was about stealing AI keys. Cloud hosting platform Railway says an attacker broke out of its build system in October, decrypted secrets from up to 100,000 customer workspaces and went hunting for AI provider API keys, which then ran up an estimated $740,000 in unauthorized AI usage.
Railway laid out the details in a long incident report published on Nov. 10, 2026, three weeks after the attack. The company says it will cover the charges that AI providers refuse to refund, and that every weakness the attacker used is now closed.
What Happened in the Railway Hack?
Railway lets developers deploy apps without managing servers. Those apps keep their passwords and API keys in environment variables, small settings the platform stores and hands to each app when it runs. That makes a host like Railway a vault full of other companies' credentials.
According to Railway, the attacker began probing its build machines at 06:50 UTC on Oct. 20. At 07:28 UTC they used a previously unknown flaw to partly escape the isolation between customer builds, which run side by side on shared virtual machines. From there they grabbed a credential that build servers use to talk to internal systems.
That credential should only have allowed things like pushing finished images. But an internal task system called Temporal accepted it as a trusted client. The attacker used it to read the stored history of 353 builds, including sealed variables, and to download a copy of Railway's internal codebase.
Railway says having the source code gave the attacker "a privileged view into how Railway works." It let them run fanouts of AI agents to look for more holes, and they found one: a misconfigured OIDC binding, the trust rule that lets automated deploy pipelines borrow short-lived cloud credentials.
At 03:26 UTC on Oct. 21 the attacker used it to get cloud access, pulled an SSH key and a longer-lived credential, and reached the database that stores customer variables. Those variables use envelope encryption, where each environment's data key is itself locked by a root key in a cloud key service. The stolen credential could unlock that chain, and the attacker decrypted variables between 04:42 and 07:14 UTC. Railway says the attacker was fully evicted at 09:24 UTC.
Why Were AI Keys the Target?
Database logs show the attacker searched for variables whose names matched AI provider keys and focused on customers with many variables. Another query also matched cloud, database and payment credentials, but Railway says forensics did not show any customer database being accessed.
Railway believes the keys were passed to "distributed transfer stations," services that relay or resell access to AI models, for use in distillation. Distillation means training a cheaper model on the answers of a stronger one. The misuse customers reported fits that picture: coding agent requests, reviews of AI agent behavior for training data and checks of training tasks. Railway adds that it has not proven whether the attacker ran those services or sold the keys on.
The company also says it was fighting "abliterated models," AI models with their safety limits stripped out, driven by an automated harness. In its own words, the response became "a contest of agent speed."
How Many Railway Users Were Affected?
| Item | Railway's figure |
|---|---|
| Workspaces with possibly decrypted variables | Up to 1.85%, about 100,000 |
| Build histories read | 353 |
| Users with linked tokens decrypted | 1,852 (BYOK agent keys, GitHub OAuth) |
| Estimated unauthorized AI spend | About $740,000 |
| Attacker access window | Oct. 20, 07:28 UTC to Oct. 21, 09:24 UTC |
| Builds fully restored | Oct. 22, 22:49 UTC |
The 100,000 figure is an upper bound, because the logs identify environments rather than individual variables. Railway reset all 1,852 linked tokens and says it saw no logins to Railway accounts with stolen credentials. Running apps stayed online, but builds were paused twice, every session was logged out and new signups were frozen from Oct. 22 to Nov. 2. Some customers who rotated keys could not redeploy and saw downtime.
Who Pays for the Stolen AI Usage?
Railway says AWS Bedrock and Google Gemini have started fraud refunds, while OpenAI and SpaceXSI review claims case by case. Talks with Anthropic are ongoing and Railway is covering those costs in the meantime. OpenRouter is sticking to its no-refund policy, so Railway says it will pay those bills itself. As BleepingComputer notes, the company first warned users on Oct. 22 and asked them to rotate every secret.
Is This Part of a Bigger Wave?
Yes. Railway says OpenCode, Warp, Fireworks AI and others disclosed similar thefts between Oct. 6 and 23. We covered how the Fireworks AI hack exposed customer datasets and billing data in a similar theft. Wiz's "Black October" research describes stolen AI credentials being tested and used by resale operations, though Railway stresses that this is context, not attribution.
Our take: an AI API key is now as good as a stolen credit card, because it turns straight into paid compute. Any platform that stores those keys for thousands of customers, from hosts to coding tools, is a high-value target. The same lesson showed up when Claude Code secrets leaked to GitHub through a single permission button.
What Has Railway Changed?
Every build now runs in its own short-lived virtual machine on top of the old isolation, with a credential that can only push one image. Railway rebuilt its CI pipeline with 2FA and biometric approval, cut service accounts to the minimum access they need and moved to short-lived credentials. All encryption and decryption is now centrally logged, and only the secrets service can unlock data keys.
Railway also admits it was slow to tell users. It warned AI providers first, starting at 09:25 UTC on Oct. 21, and sent them hashes of every key it held so they could revoke them. Next time, it says, a fixed deadline will trigger a broad notice no matter what. The company has filed a complaint with the FBI's IC3 and hired an outside forensics firm. Developer platforms keep showing up on this list, as the Northflank breach showed earlier.
What Should Developers Do Now?
- Rotate every key and token you stored on Railway since October, if you have not already.
- Check AI provider dashboards for usage spikes between Oct. 20 and today.
- Report charges you did not make through Railway's form, and open a case with your AI provider.
- Set spending caps and alerts on every AI API key.
- Use separate, narrowly scoped keys per app so one leak cannot drain your whole account.
If a friend asks whether their small Railway app is safe, the honest answer is that the hole is closed, but any key that lived there in October should be treated as burned. Replacing it takes minutes. A surprise AI bill can take weeks to dispute.