Railway Breach Cost $740,000 in Fraudulent AI Usage

Hackers extracted approximately $740,000 in fraudulent AI usage from Railway, the cloud hosting provider disclosed in an incident report published October 22. The intrusion potentially exposed decrypted customer environment variables (configuration settings containing secrets such as API keys) for up to 100,000 workspaces.

Railway set the upper bound at 1.85% of its workspaces. The company stressed this figure represents the maximum number of potentially impacted workspaces, not the confirmed count of stolen secrets. It found no evidence that attackers downloaded customer Git repositories or accessed customer databases.

How did the attackers get in?

The attack began October 20. Threat actors exploited a previously unknown vulnerability in Railway's build infrastructure (the system that compiles and packages customer applications) to escape filesystem isolation and obtain an internal credential. With that credential, they accessed stored build histories and retrieved a copy of Railway's internal source code. They then analyzed the code to identify additional ways to compromise the platform.

A second vulnerability involving an improperly configured trust relationship gave the attackers further access to Railway's infrastructure. That access yielded credentials used to decrypt customer environment variables across the affected workspaces.

What happened during the 26-hour battle?

Railway described the incident as a roughly 26-hour contest between its engineers and attackers using AI-powered agents (autonomous software programs that probe systems and exploit weaknesses) to find and exploit vulnerabilities while defenders worked in parallel to secure them.

"This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel," Railway said.

"The escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz," the company added. Abliterated models are AI models with their safety restrictions removed; a harness is the orchestration layer that drives an AI agent's actions.

Wiz is the security firm that attributed the incident to a wider campaign.

What was stolen and what does it cost?

Railway's investigation found the attackers specifically searched for AI provider credentials, although some queries also targeted cloud, database, and payment service credentials. The stolen credentials generated approximately $740,000 in unauthorized AI usage.

Railway is working with affected providers to reimburse customers. The company said it will cover charges that providers decline to refund.

The breach also exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens (authentication tokens used to authorize third-party access to GitHub accounts) and AI agent keys. Railway said it reset those tokens and notified the affected users.

Is this part of a broader campaign?

Railway linked the intrusion to a recent wave of attacks against AI developer platforms that security firm Wiz has dubbed "Black October." The campaign has targeted numerous AI development platforms during the past month, including Northflank, OpenCode, Warp, and Lightning AI.

Railway said it believes the attackers focused on stealing AI credentials for resale or for use in AI model distillation, the process of training a smaller model to replicate the outputs of a larger one.

What is the current status?

Railway removed the attackers from its systems fully on October 21. All exploited vulnerabilities have since been remediated, the company said.

Railway first disclosed the incident on October 22, warning customers to rotate their secrets after detecting unauthorized access to systems storing environment variables. The detailed incident report published today confirms the full attack chain, the scope of exposed workspaces, and the financial impact.