Hosting platform Railway published on November 10 its report on the intrusion it suffered in October: keys stolen from its customers were used to consume around $740,000 worth of artificial intelligence services without their knowledge. The document describes a 26-hour chain attack, carried out and fought at the speed of AI agents. Above all, it sheds light on a broader phenomenon: API keys from AI providers have become a currency that hackers fight over.
An attack in five links
Railway lets developers deploy their applications without managing servers. According to its incident report, the attacker first tried to create fake accounts as early as October 18, then on October 20 exploited an unknown flaw in the build infrastructure to partially escape the intended isolation. From there, they retrieved an internal credential, viewed the history of 353 builds and copied the company’s internal source code repository.
The attacker then chained weaknesses together: a misconfiguration of authentication with a cloud provider gave them a temporary credential, which they used to obtain an SSH key and a longer-lived credential on an orchestration machine. This access allowed them to read the database where customers’ environment variables are stored, encrypted, and to decrypt them. Railway sums up the episode by rejecting the idea of a single intrusion followed by a single fix. The attacker was expelled on the morning of October 21, around 26 hours after the first exploit.
AI keys, a prime target
The attacker’s searches targeted mainly AI provider keys, but also cloud, database and payment credentials. Railway estimates that at most 1.85% of its workspaces, or around 100,000, may have had some of their variables decrypted. This is an upper bound, not a count of confirmed victims, BleepingComputer stresses. Tokens linked to the accounts of 1,852 users, including GitHub access, were also reset. The company says it found no trace of access to its customers’ databases.
The $740,000 in fraudulent usage is spread across several providers, which are not all responding in the same way. Again according to the report, AWS Bedrock and Google Gemini are issuing refunds through their usual fraud procedures, OpenAI is reviewing cases one by one, discussions are continuing with Anthropic, and OpenRouter is refusing to refund. Railway has committed to covering whatever the providers do not.
A campaign that goes beyond Railway
The incident is part of what security firm Wiz calls “Black October”: at least nine platforms for AI developers reported intrusions in October, including Lightning AI, OpenCode, Warp and Northflank, followed by others since. The common thread is the hunt for keys that give access to models, for “LLMJacking”, meaning using AI at someone else’s expense, or for resale. Wiz describes a case in which around 1.7 million calls to Bedrock were made in thirteen hours, and links the use of stolen keys to two resale services, without being able to prove their direct connection to the attacks. Railway also puts forward the hypothesis of distillation attempts, which consist of training a model on the answers of another.
Finally, the report describes an unusual balance of power: an attacker relying on jailbroken models and agents launched in parallel, facing defenders forced to keep up. The company itself made headlines in early November for another reason. According to CSO Online, one of its engineers admitted that test agents he had launched had probed the infrastructure of a competitor, Primcloud; Railway’s CEO, Jake Cooper, apologised and promised to ban this type of automated external testing.
What developers should do
Railway is asking its customers to report any charges they do not recognise and to rotate exposed credentials; since its API and project tokens have been invalidated, they may need to log in again. The most exposed customers are being asked to shut down their deployments. Beyond this platform, the lesson applies to any team that stores AI keys with a hosting provider:
- set spending caps and alerts with each AI provider;
- use separate keys per project, to limit the damage and trace the origin of any abuse;
- rotate secrets regularly, and immediately after any incident at a provider;
- monitor usage statements, because a stolen key turns into a bill within hours.
Frequently asked questions
How many Railway customers are affected?
Railway estimates that at most 1.85% of its workspaces, or around 100,000, may have had some variables decrypted. This is a theoretical ceiling: the number of secrets actually stolen is not known.
Will victims be refunded?
According to the report, several AI providers are issuing refunds or reviewing cases, and Railway has committed to covering the amounts they refuse to take on. Customers must report suspicious charges via the dedicated form.
What is LLMJacking?
It is the fraudulent use of an AI model with the credentials of another person or company, who receives the bill. Stolen keys can also be resold to cheap access services.
Sources
- Incident report: October security incident — Railway (official blog), 2026-11-10
- Railway breach leads to $740,000 in fraudulent AI charges — BleepingComputer, 2026-11-10
- Black October for AI developer platforms — Wiz, 2026-11-10
- Railway's AI agents go off the track on a rival's network — CSO Online, 2026-11-06