Railway Breach Shows Stored AI Keys Are Now the Prize: About $740,000 in Unauthorized Usage, Railway Says
Railway's incident report says an attacker who escaped its build isolation on October 20 decrypted stored environment variables for at most 1.85% of workspaces, about 100,000, and specifically searched for AI provider keys. The company estimates unauthorized spend on the stolen keys at about $740,000 and says it will cover charges that AI providers will not refund. It believes the keys went to resellers for use in model distillation but has not named the attacker or said how the estimate was calculated.
The October attack on Railway, an app-hosting platform, was not after customer databases. By the company's own forensics, the attacker went looking for AI provider keys, and the bill for what they did with them is now about $740,000. It puts a dollar figure on a run of breaches at platforms that hold developers' AI credentials.
What Railway says happened#
In an incident report published on November 10, Railway says the attacker exploited a previously unknown flaw in its build infrastructure on October 20 to partly escape a build's isolation and take a build credential. That credential, which an internal workflow system accepted as trusted, exposed the stored histories of 353 builds and a copy of Railway's source code. From the code, the attacker found a misconfigured identity binding in the deployment pipeline and eventually reached a machine holding a credential that could decrypt customer variables.
Railway says the attacker obtained and decrypted a subset of customer variables for at most 1.85% of workspaces, about 100,000. Its logs identify environments, not individual variables, so that figure is an upper bound rather than a count of confirmed victims. The decrypted data also included linked-account tokens, BYOK agent keys and GitHub OAuth tokens, for 1,852 users; Railway says it reset all of them and found no logins using stolen credentials.
Why it reads as an AI-key theft#
Railway says the attacker's database queries specifically looked for variable names matching AI provider keys, though one query also matched cloud, database and payment credentials. Its forensics did not show customer databases being accessed. The company believes the keys were passed to "distributed transfer stations for use in distillation," and says the unauthorized usage it has seen ranges from coding agents to AI training pipelines.
It estimates unauthorized spend on the stolen keys at about $740,000. Refund terms vary by provider: Railway says AWS and Google have begun refunds under their fraud policies, OpenAI is reviewing claims case by case, talks with Anthropic are continuing, and OpenRouter keeps its no-refund policy. Railway says it will cover the charges providers decline to refund.
The Hacker News, reporting on November 11, noted that Railway had told customers in an October 26 update that it was "unable to refund customers for spend performed with compromised API keys." The new report reverses that position for unrefunded charges.
Part of a pattern#
Railway lists OpenCode, Warp and Fireworks AI among platforms that disclosed similar thefts between October 6 and 23, and calls its breach "one of a series of attacks on platforms that hold AI keys." Times of AI has covered OpenCode's console breach and its distillation angle and Fireworks AI's second breach disclosure. The Hacker News adds that Wiz researchers counted at least nine AI developer platforms disclosing incidents in October, with no single flaw linking them.
Limits#
- The account of the attack, the 100,000-workspace ceiling and the $740,000 estimate are Railway's own; it has not said how the estimate was calculated or what period it covers.
- Railway has not named the attacker or established whether the attacker ran the reselling services it describes.
- Railway published its report on November 10. Independent reporting on the figures followed on November 11.