Category: Security | Reading time: 3 min
App-hosting platform Railway says AI provider keys stolen from customers in its October breach were used for an estimated $740,000 in unauthorized spending. In its incident report, published November 10, Railway said it will pay those charges itself when an AI provider will not refund them. On October 26 it had told customers it was unable to refund spend made with compromised keys.
What was taken
Railway stores customer secrets such as API keys and database credentials as environment variables. The attacker decrypted variables in at most 1.85% of workspaces, about 100,000, and its database queries looked specifically for AI provider keys. One query also matched cloud, database and payment credentials. The decrypted data included linked-account tokens for 1,852 users, BYOK agent keys and GitHub OAuth tokens, all of which were reset. The attacker also read the stored histories of 353 builds, including the secrets passed to them. Railway found no customer database access and no sign that code repositories were downloaded.
How the attacker got in
According to the report, the attacker exploited a previously unknown flaw on October 20 to partly escape a build's isolation and read a credential meant only for build work. Railway's internal Temporal system accepted that credential as a trusted client, which let the attacker read other builds' histories and fetch a copy of the internal monorepo. From that code the attacker found a misconfigured OIDC binding, obtained a short-lived cloud credential, and chained it to an SSH key for a fleet orchestration machine that held a credential able to decrypt customer variables. The attacker was removed on October 21. Railway says every weakness used is now closed.
Who pays
Refund terms differ by provider. AWS Bedrock and Google Gemini refunds are underway under existing fraud policies. OpenAI reviews claims case by case. Railway will cover Anthropic costs while talks continue, and all OpenRouter costs, since OpenRouter keeps a no-refund policy. The report does not say how the $740,000 figure was estimated, what period it covers, or whether claims have a cap or deadline. Railway believes the keys were used by services that resell AI access for model distillation, and has not named the attacker.
Why it matters
Each step in this breach used a credential that was trusted beyond its purpose: a build credential accepted by an internal system, a deployment binding that issued cloud access, a machine that could decrypt every customer's secrets. Wiz lists Railway among at least nine AI developer platforms that disclosed breaches in October, all with attackers hunting for stored AI keys. For enterprises, an AI key is now a payment instrument, and the question of who authorized each use, and who pays when no one did, is no longer theoretical.
Source: The Hacker News