Cloud platform Railway published an incident report on 10 November about a breach that took place on 20–21 October. The attacker decrypted some customers’ environment variables, the report said. Developers use these variables to store API keys and other secrets for their applications.

Variables could have been decrypted in at most 1.85 per cent of workspaces, about 100,000, Railway said. The figure is an upper bound because the logs show only the environments the attacker targeted, not individual variables. The attacker also obtained linked-account tokens for 1,852 users, such as GitHub OAuth tokens and users’ own AI agent keys. Railway reset them.

From build server to decryption keys

Railway said that on 20 October the attacker partially broke out of isolation on a server that builds runnable applications from customer code. On that server the attacker found an internal token that the job-runner system accepted as trusted. With it, the attacker read the data of 353 other builds, variables included, and copied Railway’s internal code repository.

In the code, the attacker found a misconfigured trust relationship between Railway’s release pipeline and its cloud environment. This gave the attacker access on 21 October to a server holding a long-lived credential for decrypting variables. Railway encrypts variables with per-environment keys, which are in turn encrypted with a master key held in the cloud provider’s key management service.

According to database logs, the attacker prioritised variables whose names suggested an AI provider key. The attacker targeted customers with large numbers of variables and used the credential it had found to decrypt some of the variables it retrieved. About 26 hours passed between the first intrusion and the attacker’s eviction. Railway said the attacker used models stripped of their safety restrictions. Security firm Wiz assessed that the attacker also used a harness similar to ARTEX: a program that directs an agent, giving the model tools and running its steps.

Railway said there is no sign that the attacker downloaded customer repositories, and the investigation does not suggest the attacker reached customer databases. An external forensics firm is still investigating. The weaknesses the attacker exploited have been fixed, the company said.

Costs and refunds

Railway estimates that the stolen keys were used to run up about $740,000 in unauthorised spend. The company believes the keys were passed on to services that resell AI access for distillation, that is, training a model on another model’s outputs. Railway has not established whether the attacker ran these services itself or supplied the keys to others. Wiz’s ‘Black October’ report describes a similar pattern of activity but does not independently link the Railway breach to a specific actor, Railway said. OpenCode, Warp and Fireworks AI also reported similar thefts between 6 and 23 October, according to Railway.

Railway asks customers to report unauthorised charges through its form. AWS and Google refund fraud-related charges under their own policies. OpenAI and SpaceXSI assess cases individually. Customers whose OpenAI keys were misused open a support ticket with OpenAI and pass the case number to Railway support. For charges incurred on SpaceXSI keys, customers contact Railway support. Negotiations with Anthropic are ongoing, and in the meantime Railway is paying the unauthorised charges incurred on Anthropic keys itself. Railway is also paying unauthorised charges incurred through OpenRouter, because OpenRouter does not refund them.