Cloud hosting provider Railway said on November 10 that attackers used stolen customer credentials to generate roughly $740,000 in unauthorized AI usage, and that it will pay charges that AI providers decline to refund. The company disclosed the intrusion on October 22 and says the attackers were fully removed from its systems by October 21, with the exploited flaws since remediated. A seven-figure cloud invoice is the rare heist in which the victim receives the bill.
The mechanics matter to anyone who stores secrets on someone else’s platform. The intrusion began on October 20, when an intruder exploited a previously unknown flaw in Railway’s build infrastructure to partially escape a build’s filesystem isolation and read files on the host, obtaining an internal credential used by the build system. A second issue involving an improperly configured trust relationship then yielded the credential used to decrypt customer environment variables. Railway says the attacker decrypted variables in at most 1.85 percent of workspaces, about 100,000, and describes that figure as an upper bound rather than a confirmed count. Forensics found no evidence that customer databases were accessed or code repositories downloaded. The attacker’s database queries specifically looked for AI provider keys, though some queries also matched cloud, database, and payment credentials; 1,852 users had linked-account tokens, including GitHub OAuth tokens and agent keys, reset and notified.
The AI angle is the genuinely new part of a familiar story. Railway describes the incident as a roughly 26-hour contest in which attackers used AI-powered agents to probe and exploit routes in parallel while defenders hardened in parallel, and links the campaign to a recent wave of attacks against AI developer platforms that security firm Wiz has dubbed “Black October,” which also touched Northflank, OpenCode, Warp, and Lightning AI. Railway believes the stolen keys were intended for resale or model distillation. Attackers running agent swarms against defenders running agent swarms is less a breach story than a weather report.
For normal companies, the takeaway is blunt: an AI API key is no longer just a secret, it is a billing instrument. Every provider key you store anywhere — in a platform, a CI system, a notebook, a prototype someone forgot — is a credit card you left at a hotel you do not own, and the attacker does not need to extort you when the meter is running.
Treat the incident as a rotation drill even if you were never on Railway. Revoke and replace any credential stored on any affected platform before October 21, using the issuing provider, because filing a charge report is not revocation. Audit which applications your GitHub account has granted access to, and check audit logs in registries like Docker Hub. Remove public network exposure from databases that do not need it. And put billing alerts on every AI account you own; a $740,000 surprise is a detection failure before it is a budget problem. Alerts should fire at $740. The meter, unlike the beaver, never sleeps and never forgives.
Sources
Original reporting — the facts belong to their owners; the opinions and rodents are ours.