Railway’s final report: stolen AI keys ran up about $740,000 in charges

Cloud hosting platform Railway has published its full incident report on the break-in it first disclosed on October 21. We covered the first disclosure in Railway says some customer environment variables may have been read. The new report fills in how the attacker got in, what they were after and what it cost customers: Railway estimates that keys stolen in the attack were used for about $740,000 of AI usage that customers didn’t authorize, and says it will pay any of that the AI providers won’t refund.

If you don’t have a Railway project, this doesn’t affect you directly. If you do, the short version is the same as in October: rotate secrets you stored in Railway, and check your AI provider bills.

How the attacker got in

Railway’s timeline, all in UTC, runs over about 26 hours:

• October 18: the attacker started signing up dummy accounts. Railway says its automated systems stopped every attempt in this early probing.
• October 20, 07:28: the attacker used a previously unknown flaw in Railway’s build system to partly escape the isolation between builds and read a credential the build servers use. With it, they read the stored histories of 353 builds, including the variables passed to them, and pulled a copy of Railway’s internal source code.
• October 20, 13:58: an alert about unusual API calls paged Railway’s on-call engineer. Railway halted builds, replaced the credential and restricted what build servers can reach.
• October 21, 03:26: working from the stolen source code, the attacker found a wrongly configured trust setting in one of Railway’s cloud environments and used it to get short-lived cloud credentials. From there they reached a machine holding a longer-lived credential that could decrypt customer environment variables.
• October 21, 04:07 to 07:14: the attacker pulled encrypted variables from Railway’s database, searching for names that looked like AI provider keys, and decrypted some of them. Railway disabled every cloud credential and the decryption service at 07:14.
• October 21, 09:24: Railway says the attacker was fully removed.

Railway describes the response as “a contest of agent speed”, with the attacker using AI agents to try many routes at once while engineers closed them.

What was taken

Railway says logging lets it confirm that at most 1.85 percent of workspaces, about 100,000, could have had any variables decrypted. That figure is an upper bound: the logs show which environments were touched, not which individual variables. The attacker was mainly after AI provider keys, though one query also matched cloud, database and payment service credentials. Railway says it found no sign that customer databases were accessed or that customer code repositories were downloaded.

The decrypted data also included linked-account tokens, such as GitHub sign-in tokens and AI agent keys, for 1,852 users. Railway says it reset all of them, told each user, and saw no logins to Railway accounts using anything taken in the incident.

During the attack, Railway asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke keys that might be exposed. Some revoked more than Railway asked, which is why some customers outside the affected group saw keys reset.

Where the stolen keys went

Customers shared examples of how their stolen keys were used afterward: coding-agent requests, reviews of AI agent behaviour for training data and checks of training tasks. Railway says this is consistent with stolen credentials being passed to services that resell access to AI providers, and that it believes the attacker wanted keys “for use in distillation”, which means training other AI models on a provider’s outputs. It says it hasn’t established whether the attacker ran those resale services.

Railway links the attack to a wider run of break-ins at platforms that hold AI keys. It names OpenCode, Warp and Fireworks AI among companies that disclosed similar thefts between October 6 and 23. We’ve covered OpenCode, Warp, Northflank and Fireworks AI. Railway cites research by the security firm Wiz, which calls the pattern “Black October”, as context, while noting that Wiz’s work doesn’t attribute the Railway attack to a specific group.

What you can do if you use Railway

1. Rotate any secret that lived in a Railway variable, if you haven’t already: AI keys, database passwords, cloud keys, payment keys and registry logins. Railway hasn’t published a list you can check yourself.
2. Check your AI provider usage and billing from October 20 onward. Unexpected spend is the clearest sign a key was used. Railway says it is working with providers on refunds and will cover charges they decline.
3. Revoke old GitHub tokens on GitHub’s side, not only by reconnecting in Railway, as Railway explained in October.
4. Watch for Railway-themed emails asking you to “verify” keys or billing. Go to your dashboard yourself instead of clicking links.

How Frame helps

This incident is about developer secrets, not personal details like home addresses or passwords for consumer accounts, so there isn’t a breach to add in Frame. Frame can also look up your verified emails in Have I Been Pwned’s breach database for other breaches. Frame never collects or stores leaked records, and it doesn’t manage API keys.

Related coverage

• Railway says some customer environment variables may have been read: our coverage of Railway’s first disclosure in October.
• Fireworks AI says a second intrusion reached billing details, datasets and partial models: another AI platform in the same run of attacks.
• OpenCode Console breach: stolen AI API keys ran up users’ bills: an earlier theft of AI keys from a developer platform, with the same kind of surprise bills.

Sources

• Railway, Incident report: October security incident, November 10, 2026
• Railway, Security disclosure: Wednesday October 21st, October 21, 2026
• BleepingComputer, Railway breach leads to $740,000 in fraudulent AI charges, November 10, 2026