Hackers Stole AI Keys From 100,000 Railway Workspaces and Ran Up $740,000 in Fraudulent Charges

admin · November 12, 2026 · 7 min read

Illustration of a glowing digital key and streams of data escaping a cracked server in a dark server room after the Railway hack

Cloud hosting platform Railway says hackers broke into its systems in October, stole artificial intelligence provider credentials from as many as 100,000 customer workspaces, and ran up about $740,000 in fraudulent AI usage charges. The company disclosed the full scale of the attack in a detailed incident report published on November 10, three weeks after the intrusion.

The attackers were not after customer data or source code. Railway’s forensic investigation found they were hunting for one thing: AI provider API keys, the credentials that unlock paid access to powerful AI models. The company believes the stolen keys were passed on to so-called distributed transfer stations, services that resell model access for use in training cheaper AI systems.

A 26-hour battle inside Railway’s build system

The attack began on October 20. At 7:28 a.m. UTC, the intruders exploited a previously unknown vulnerability in Railway’s build infrastructure and partially escaped the filesystem isolation that is supposed to keep one customer’s build separate from another’s. That gave them a credential the company’s build servers use to authenticate to internal systems.

From there, the attackers read the stored histories of 353 builds and retrieved a copy of Railway’s own internal source code. With that privileged view of how the platform works, they scanned the code for more ways in and found one: an erroneously defined OIDC binding, a misconfigured trust relationship in one of Railway’s cloud environments.

At 3:26 a.m. UTC on October 21, they used that flaw to obtain short-lived cloud credentials, then used those to reach an orchestration machine holding a longer-lived credential that could decrypt customer environment variables. Between 4:42 a.m. and 7:15 a.m. UTC, they decrypted a subset of those variables.

Railway engineers, who had been paged at 1:58 p.m. UTC on October 20 after spotting anomalous API calls, fought the intruders for nearly 26 hours. The company disabled all active cloud credentials, revoked static credentials, shut down the key decryption service, and halted builds twice. The attackers were fully evicted at 9:24 a.m. UTC on October 21. Railway described the fight as a “contest of agent speed,” saying it was defending against AI models with their safety limits stripped out, driven by an automated harness.

What was taken, and who pays

Railway says at most 1.85 percent of workspaces, about 100,000, could have had any of their environment variables decrypted. The company stressed that the figure is an upper bound: its logs identify affected environments, not individual variables. It emailed customers judged to be at high risk.

Database logs showed the attackers specifically searched for AI provider keys, using regular expressions that matched variable names and prioritizing customers with large numbers of variables. Some queries also matched cloud, database, and payment service credentials. The stolen keys were then used to run coding agents, AI training pipelines, and checks of training tasks that the real owners never ran.

The breach also exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and bring-your-own-key agent tokens. Railway says it reset every one of them and found no logins to Railway accounts using stolen credentials. It also says its forensic work found no indication that customer databases were accessed or that customer code repositories were downloaded.

The fraudulent AI usage is estimated at about $740,000. Railway says it is working with providers to refund the charges and will cover the cost itself where a provider refuses. Amazon Bedrock and Google Gemini are refunding under their fraud policies, while OpenAI and SpaceX’s AI service are reviewing claims case by case. Railway first disclosed the incident on October 22 and has filed a complaint with the FBI’s Internet Crime Complaint Center.

Part of a wider campaign targeting AI keys

Railway is not an isolated case. Security firm Wiz has named the wider spree “Black October”: OpenCode, Warp, Fireworks AI, Lightning AI, and several other developer platforms disclosed similar thefts of AI credentials between October 6 and 23. Wiz found that stolen keys were typically tested within 30 minutes of being taken, then flooded with traffic four to seven days later.

Security experts say the pattern marks a shift in what criminals steal. “AI credentials are becoming the new credit card numbers,” David Shipley of Beauceron Security told CSO Online. “So-called LLMjacking is expected to displace cryptojacking as a cheap, scalable way to make money.”

Frank Dickson of Dickson Research called the theft “the 2026 version of cryptomining; [the] same playbook with a different output.” Training one model on another’s answers takes millions of questions, he explained, and a single account asking that many stands out. Stolen keys spread those questions across thousands of real customers, so the key owner gets the bill while the thief gets free computing power.

The incident is the latest sign that AI systems are now both a target and a weapon in cyberattacks. Researchers recently showed how a Silent Lynx AI agent stole 2,000 government documents in Tajikistan, and Google patched its eighth actively exploited Chrome zero-day of 2026 this week, a reminder that the pressure on software supply chains is not letting up.

Why this matters

For developers, the Railway breach is a warning that an API key is now as valuable to a thief as a credit card number, and far easier to spend at scale. A single leaked key can be tested within minutes and burned through thousands of dollars of model usage before the owner notices the bill.

Railway has advised customers to revoke and reapply any sensitive environment variables stored on the platform before October 21, remove public network access to databases, rotate cloud and payment credentials, and check GitHub audit logs. The company says it is moving to short-lived credentials, logging every decryption, and rebuilding the tooling that runs its infrastructure.

Dickson’s advice applies well beyond Railway’s customers: set hard spending caps and usage alerts on every AI key, scope each key as narrowly as the provider allows, and issue as few keys as possible. “Protect machine identities like cash,” he said, “because to a thief, that is exactly what they are.”

Frequently asked questions

What happened in the Railway hack?

Hackers exploited a vulnerability in Railway’s build infrastructure on October 20, 2026, escaped filesystem isolation, and decrypted environment variables from up to 100,000 workspaces. They were fully evicted about 26 hours later, on October 21.

What did the attackers steal?

Primarily AI provider API keys, which they used to run up about $740,000 in fraudulent AI usage. Linked-account tokens for 1,852 users were also exposed and reset. Railway says no customer databases were accessed.

Was Railway the only platform hit?

No. Security firm Wiz links the attack to a wider “Black October” campaign in which several developer platforms, including OpenCode, Warp, and Fireworks AI, reported similar thefts of AI credentials in October.

What should Railway customers do now?

Railway advised customers to revoke and reapply sensitive variables stored before October 21, rotate AI, cloud, database, and payment credentials, check provider bills and usage logs for traffic they did not generate, and report unauthorized charges to Railway.

What happens next

Railway says its forensic investigation is ongoing and it will publish indicators of compromise once law enforcement clears them. The company has rebuilt much of its infrastructure and added the ability to mass-revoke app permissions if suspicious activity appears. For the rest of the industry, the open question is how quickly other platforms holding customer secrets adopt the same fixes, because the attackers have shown that AI keys are now the prize worth stealing.