Hackers Burned $740,000 in Stolen AI Compute; Railway Ate the Bill

Attackers walked off with roughly $740,000 in fraudulent AI compute, and cloud hosting provider Railway has confirmed it will cover the tab — including charges AI providers refuse to refund.

The incident began October 20, when hackers exploited a previously unknown vulnerability in Railway's build infrastructure. They evaded filesystem isolation protections, grabbed an internal credential, and pulled stored build histories. From there they retrieved a copy of Railway's internal source code and picked it apart for further ways in.

They found one. A second vulnerability — an improperly configured trust relationship — handed them deeper access and the credentials needed to decrypt customer environment variables. Over nearly 26 hours, Railway's engineers worked around the clock in shifts against intruders who chained exploits, moved laterally, and "probed many potential routes, in parallel." Railway hardened routes in parallel too, calling it a "contest of agent speed."

"This was not a single breach followed by a single fix," the company wrote in its follow-up incident report this week, after an initial disclosure on October 22.

What did the attackers actually take?

The intruders decrypted a subset of customer variables — roughly 100,000, or "at most" 1.85% of workspaces. They also exposed linked-account tokens belonging to more than 1,850 users, including GitHub and OAuth tokens, which Railway reset. Working with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe and others, the company revoked potentially compromised keys.

The $740,000 in bogus charges showed up as customers' keys answering coding questions and running training-data tasks they never initiated. Railway's own forensic searches found the attacker's database queries hunted for AI provider keys by name before anything else; some queries also targeted cloud, database, and payment credentials.

Because the investigation continues, Railway can't share full details on the exploits' scale, but it has told users to revoke and reapply any sensitive environment variables stored on the platform before October 21.

Why are AI keys the new prize?

"AI credentials are becoming the new credit card numbers," said David Shipley of Beauceron Security. "So-called LLMjacking is expected to displace Cryptojacking as a cheap, scalable way to make money."

The economics are brutally simple. AI credentials are cheap to harvest at scale — hit one provider like Railway rather than one company at a time — and the access can be resold through AI "transfer stations" or routers offering models most buyers couldn't otherwise afford or reach.

Frank Dickson of Dickson Research put the distillation angle in plain terms: training one model on another model's answers takes millions of questions, and a single account asking millions stands out instantly. Stolen keys spread those questions across thousands of real customers.

"Think of copying a textbook one page at a time, using library cards that belong to other people," Dickson said. "It is the 2026 version of cryptomining; same playbook with a different output."

What should security teams do now?

Railway customers should treat every secret stored on the platform as stolen until rotated, Dickson said — and rotation has to beat the thief's clock. A Wiz investigation found stolen keys get tested within 30 minutes of theft, then flooded with traffic four to seven days later.

His prioritized checklist:

• Rotate AI provider keys first, then cloud, database, and payment credentials
• Check AI provider bills and usage logs for traffic your teams didn't generate; report unauthorized charges to Railway
• Alert on any API call from an unrecognized address
• Check GitHub account audit logs, review all app access, and audit registry logs such as DockerHub
• Remove public network access to databases
• Set hard spending caps and usage alerts on every AI key, and scope each key as narrowly as the provider allows

That last point has teeth: in one case Wiz examined, a key restricted to a narrow set of model profiles left most of the thief's traffic throttled.

Non-Railway shops should press their platform providers with two questions: how are my secrets stored, and who can decrypt them? And issue fewer keys. "No one ever said during a key rotation that they wished they had issued more keys," Dickson noted.

On its side, Railway has shut down potentially compromised internal tooling, rolled all keys and rerolled them after confirming eviction, migrated to a new generation of infrastructure, rebuilt its infrastructure tooling, added mass-revoke capability for app permissions, and is moving to short-lived credentials with logging on every decryption — a fix Dickson says every platform holding customer secrets should copy.

The closer, in his words: "Protect machine identities like cash, because to a thief, that is exactly what they are."