Railway Says October Attackers Targeted AI Provider Keys, With About $740,000 in Unauthorized Spend
The hosting company's full incident report says at most about 100,000 workspaces could have had secrets decrypted — an upper bound — and that it believes stolen keys were passed to resale 'transfer stations' for distillation.
Published
Last updated / Fact-checked on
Illustrative photo of an open combination padlock standing on a silver laptop keyboard; it is not Railway or any system named in this article. The lock's number wheels are visible, and the keyboard includes labeled keys such as "delete" and a return key. No company logo is visible.
Railway, the cloud hosting company, published its full report Tuesday on the October attack on its systems and says it believes the attacker was "specifically targeting AI provider credentials." Railway estimates unauthorized spend on the stolen keys at about $740,000.
Railway says at most 1.85% of its workspaces, about 100,000, could have had any environment variables decrypted — an upper bound, because its logs identify environments, not individual variables. It also says it believes the stolen keys were passed on to what it calls "distributed transfer stations" for use in distillation.
At a glance
| Item | Detail | Source/status |
|---|---|---|
| What was targeted | AI provider keys, per Railway's forensics | Railway, Nov. 10 report |
| Scope | At most 1.85% of workspaces (~100,000); upper bound | Railway; logs show environments, not variables |
| Estimated unauthorized spend | About $740,000 | Railway estimate |
| Linked-account tokens | 1,852 users; all reset; no account logins found | Railway |
| Where keys went | "Distributed transfer stations" for distillation | Railway's belief; not established who ran them |
| Others named | OpenCode, Warp, Fireworks AI, "several others" | Railway; no shared attacker claimed |
| Status | IC3 complaint filed; forensics firm investigation ongoing | Railway |
How Railway says the attacker got in
After unsuccessful dummy-account sign-ups starting Oct. 18, Railway says, the attacker began probing its build infrastructure on Oct. 20 (UTC). A previously unknown vulnerability let the attacker partially escape a build's filesystem isolation and obtain a build credential, which an internal Temporal system accepted as a trusted client. That exposed stored histories of 353 builds, sealed variables included, and a copy of Railway's internal monorepo. Railway says it has no indication that customer snapshots or repositories were downloaded.
Using that code, Railway says, the attacker found an erroneously defined OIDC binding on Oct. 21 (UTC) and worked from a short-lived cloud credential to a longer-lived one able to decrypt envelope-encrypted variables. Railway says any further data the attacker may have taken cannot be decrypted because it disabled the credential the attacker was using.
What was exposed, and what Railway says was not
Railway says database logs show the attacker prioritizing AI provider keys, selecting variables whose names matched attacker-provided regular expressions, and targeting customers with many variables.
Railway says the decrypted data included linked-account tokens (BYOK agent keys and GitHub OAuth tokens) for 1,852 users, and that it reset every one, notified each user and "identified no logins to Railway accounts using credentials taken in this incident." Another query matched cloud, database and payment service credentials, but Railway says "forensics did not indicate customer databases were accessed." Railway also asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke potentially compromised keys.
Refunds, fixes and the wider pattern
The $740,000 is Railway's estimate, not a confirmed loss. Railway says AWS Bedrock and Google Gemini have initiated refunds and OpenAI and SpaceXSI are reviewing case by case. Railway is covering Anthropic breached-key costs while talks continue, and will cover OpenRouter costs because OpenRouter is keeping its no-refund policy.
Fixes Railway lists include a dedicated ephemeral virtual machine per build, CI rebuilt with 2FA approval, and centrally audit-logged decryption limited to the secrets service. Railway says each attack vector has been remediated, "with every weakness the attacker exploited now closed." It filed a complaint with the FBI's IC3, and a specialist forensics firm's investigation is ongoing.
Railway says the misuse it has observed, from coding agents to AI training pipelines, is "consistent with compromised credentials being distributed through services that relay or resell access to AI providers." It says it has "not established whether the original attacker operated those services or supplied credentials to other parties." Railway believes the keys were wanted for distillation — using access to AI models to train other models.
Railway also says "OpenCode, Warp, Fireworks AI, and several others disclosed similar thefts between October 6th-23rd," and calls this "one of a series of attacks on platforms that hold AI keys." It does not say the same attacker was behind those incidents. DailyMech reported Fireworks AI's latest update on its own incident on Nov. 9.
What to watch
Railway's further updates and any indicators of compromise, which it says it will share after law enforcement sign-off. Provider refund decisions, especially Anthropic's. Further disclosures from other AI developer platforms.
How we reported this
DailyMech read Railway's Nov. 10 incident report and its Oct. 22 preliminary report in full. All figures and beliefs here are Railway's own account and were not independently verified. BleepingComputer's report could not be opened, and other secondary coverage was not used. DailyMech contacted no one.
Published and fact-checked November 10, 2026.
Sources
- Railway, "Incident Report: October 21st Security Attack," by Jacob Cooper, Angelo Saraceno, Sarah Bedell and Luca Casonato, Nov. 10, 2026 (last updated November 10, 18:02 UTC (10:02 AM PST)), fully read, https://blog.railway.com/p/incident-report-october-security-incident
- Railway, "Preliminary Report: Oct 21st Security Incident," Oct. 22, 2026 (with Monday, October 26 update), fully read, https://blog.railway.com/p/preliminary-report-october-security-incident
DailyMech used AI tools to help research and draft this article; it was fact-checked by our editors.