Railway: AI provider keys stolen from ~100,000 environments, $740k in unauthorized AI spend
Railway says attackers stole AI provider keys from about 100,000 environments and used them to generate roughly $740,000 in unauthorized AI compute spend, though the full scope of exfiltrated secrets remains unclear.
Railway’s build and identity trust layers were cracked twice in October, letting attackers siphon AI provider keys and drive about $740,000 in unauthorized compute spend
Railway, a cloud build and hosting platform, disclosed that attackers broke into its internal build trust and then abused its identity provider (OIDC) configuration to pull cloud credentials. The breach exposed AI API keys stored by customers on Railway, which were then used to generate roughly $740,000 in fraudulent AI service charges. While the company says the worst of the damage is known and controls have been rebuilt, the episode shows how a single compromised identity or build can propagate widely when secrets are centralized and permissions are too broad.
How the intruders got in
Railway’s incident report points to two specific failures. First, a malicious actor exploited a known isolation bypass in Railway’s build VMs on October 20, 2026. Because Railway builds run in isolated containers, this bypass let the attacker reach into the shared environment and read build artifacts and, crucially, environment variables that held AI provider keys. Once inside that shared environment, the attacker then used a credential that was reused through Railway’s Temporal workflow system to read build histories and other internal data.
Second, Railway’s OpenID Connect (OIDC) configuration was misconfigured, which allowed the attacker to retrieve cloud credentials after they had already accessed the build environment. The combination—escape from an isolated build plus a misconfigured trust boundary—let the intruder move laterally and harvest a mix of AI keys, GitHub OAuth tokens, and BYOK agent tokens. The incident report estimates that about 1.85% of customer workspaces, roughly 100,000 environments, had their environment variables decrypted, and 353 build histories containing AI keys were read.
What was actually taken and how it was used
From the decrypted environment variables, attackers pulled AI provider keys for services such as OpenAI, Google, Anthropic, AWS, and OpenRouter. The stolen keys were used to generate unauthorized AI compute spend, which Railway estimates at about $740,000. The breach also gave access to 1,852 linked-account token pairs (BYOK agents and GitHub OAuth tokens) and allowed reading of 353 build histories and parts of an internal monorepo.
The scale is notable: even though only 1.85% of workspaces were fully decrypted, the number of affected environments—roughly 100,000—means a significant slice of Railway’s customer base had at least some environment variables exposed. The attackers didn’t just read data; they turned those keys into actual spending by routing them to AI services that billed per token or per call.
What Railway has done and what’s still uncertain
Railway rebuilt its build infrastructure starting November 2, 2026, and by November 4 the company says full recovery was achieved. The platform has since hardened CI with multi‑factor authentication and biometrics, centralized secret vaults with scoped decryption keys, and installed a new root certificate authority. It also disabled new signups after November 2 and has updated its NPS (Net Promoter Score) system to notify customers once an impact assessment is complete. The company has engaged the FBI’s IC3 unit and forensic specialists, and is working with AI providers on financial recovery.
What we don’t know is how many customers actually lost data beyond the environment variables that were decrypted. Railway’s own disclosure focuses on the AI key usage and the credential theft, but it hasn’t published a full list of affected customers or confirmed whether any proprietary code or additional secrets beyond the AI keys were exfiltrated. There’s also the open question of whether the attacker reused any of the stolen keys after Railway shut down access on November 4. The company says all known vulnerabilities have been patched, but without full forensic logs the true blast radius remains partially obscured. In short, the immediate path for abuse has been closed, but the full picture of what was taken—and whether any secrets remain in the wild—still needs to be verified.
