An attacker who broke into Railway’s cloud hosting platform in October decrypted customer environment variables for at most 1.85 percent of its workspaces, about 100,000, the company says. Keys stolen in the attack ran up an estimated $740,000 in unauthorized AI usage. The figures come from a full incident report published on November 10.

The intrusion began at 07:28 UTC on October 20, when the attacker exploited a previously unknown flaw in Railway’s multi-tenant build system to partially escape filesystem isolation and read a credential that build servers use to push images. An internal workflow service accepted that credential as a trusted client. Using it, the attacker read the stored histories of 353 builds, including sealed variables, and retrieved a copy of the internal monorepo behind many of Railway’s services.

Railway says the attacker then scanned the code for other ways in and found an erroneously defined OIDC binding in one of Railway’s cloud environments. At 03:26 UTC on October 21, the attacker used it to obtain a short-lived cloud credential. That led to an SSH key and an orchestration machine holding a longer-lived credential that could decrypt customer variables.

Database logs show the attacker selected rows whose variable names matched patterns for AI provider keys and targeted customers with large numbers of variables; another query matched cloud, database and payment service credentials. Decryption ran from 04:42 UTC until 07:14 UTC, when Railway disabled all active cloud credentials and the key decryption service. Railway says the attacker had no access to customer data after 09:25 UTC on October 21, and that the 100,000 figure is an upper bound because its logs identify environments rather than individual variables.

The attacker probed many routes in parallel while Railway’s engineers hardened them, in what the company calls “a contest of agent speed.” Railway says it was “defending against abliterated models and a harness similar to ARTEX, according to Wiz,” and that evidence indicates the models had no safeguards. WorkOS has said a researcher’s AI agent running ARTEX, an autonomous penetration-testing framework, breached one of its internal tools in October.

The decrypted data also included linked-account tokens, among them GitHub OAuth tokens and agent keys, for 1,852 users. Railway reset them and says it found no logins to Railway accounts using credentials taken in the incident. It asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke potentially exposed keys.

Railway believes the stolen keys were passed on to services that relay or resell AI access, for use in distillation, but says it has not established whether the original attacker ran those services. Railway says AWS and Google have begun refunding fraudulent charges and OpenAI and SpaceXSI are reviewing claims. It is covering Anthropic-related costs for now and will pay OpenRouter charges and any losses other providers decline to refund.

Wiz counts at least nine AI developer platforms, Railway among them, that disclosed security incidents in October, including Fireworks AI, OpenCode and Warp; more have followed in November. In two cases Wiz described, enterprise AWS keys from one of the breaches, which it did not identify, were first tested within 30 minutes of the theft. One key was later used for about 800,000 Amazon Bedrock calls and the other for about 1.7 million, mostly to Anthropic’s Claude models. Railway says Wiz’s research provides context for its findings but does not independently attribute the Railway incident.

Each build now runs on its own ephemeral virtual machine, Railway says. It has filed a complaint with the FBI’s Internet Crime Complaint Center, and a specialist forensics firm is still investigating.

Sources: Railway, Wiz, BleepingComputer

–
By the Control Plane Editorial Team