The platform, Railway, says the attacker may have decrypted stored passwords and keys in as many as 100,000 customer accounts.
Railway, a cloud platform where software developers host and run their apps, said in an incident report that an attacker broke in on Oct. 20 and 21 and went after the AI service keys customers stored there. An app uses such a key to reach an AI company’s models, and the AI company bills the key’s owner. Railway estimates that unauthorized AI charges on the stolen keys could reach about $740,000.
Customers store passwords and keys with Railway, so their apps can log in to other services. Railway says the attacker decrypted some of them. It can’t tell which individual keys were taken, so it estimates up to 100,000 customer accounts could be affected.
The attacker found two ways into Railway
According to Railway, the attacker found two ways in. The first, on Oct. 20, was an unknown security flaw in the Railway service that turns customers’ code into running apps. Through the flaw, the attacker stole an internal Railway login and used it to copy Railway’s internal code. Railway engineers detected the attacker that afternoon, paused new deployments of customers’ apps, and shut off the stolen login. But the attacker still had the copied code. On Oct. 21, the attacker used it to find a cloud setting Railway had wrongly configured. That gave the attacker a second way in, which led to the database of stored customer passwords and keys.
Railway says the attacker moved fast, setting up many AI agents to search the copied code for security flaws at once, using AI models with their safety limits stripped out.
AI service keys were the attacker’s main target
Railway says its database records show the attacker searched specifically for AI service keys, by matching the names customers give their stored keys. The attacker went after customers who stored large numbers of passwords and keys. One of the attacker’s searches also turned up passwords and keys for cloud, database, and payment services. Railway found no sign that the attacker reached customer databases.
Railway says the attacker also decrypted the personal AI service keys and GitHub access of 1,852 Railway users. It reset them all and found no one had logged in to Railway with stolen passwords or keys.
Railway believes the keys fed AI model copying
Railway believes the attacker planned to sell the AI service keys to transfer stations, services that resell access to AI models using stolen keys, so the keys’ owners pay for the usage. The transfer stations’ customers would then use that access for distillation, training a new AI model on a leading model’s answers to copy its abilities.
Since the attack, Railway has seen the stolen keys used for AI coding tools and AI training work. It doesn’t yet know whether the attacker sold the keys or ran a transfer station itself.
Railway had keys revoked before warning customers
Railway contacted the companies that issued the keys before it warned customers. On the morning of Oct. 21, it asked eight of them to revoke any keys that might have been exposed. They included OpenAI, Anthropic, Google, and GitHub.
Railway says it warned the companies first so they could revoke keys while it secured its systems. It waited to warn customers until it knew who was affected. It also wanted to be sure the attacker was out so that new keys wouldn’t be stolen too. Railway posted a general warning on its status page late on Oct. 21, about 12 hours after it alerted the companies.
Customers asked Railway why it delayed warning them. Railway says that next time, it will set a deadline for confirming who was affected, then send customers a general warning when the deadline passes, even if that work isn’t done.
Railway says some customer apps broke once the old keys were revoked, because they could no longer log in to the services they used. Customers couldn’t load new keys into those apps because Railway had frozen all app updates during the attack. Railway restored app updates over the course of Oct. 22.
Some AI companies won’t refund the stolen-key charges
Railway says it will pay the charges that AI companies won’t refund. Their policies differ:
- Amazon and Google are refunding customers under their fraud policies.
- OpenAI is reviewing claims case by case.
- Elon Musk’s AI company, which makes the Grok chatbot, is also reviewing claims case by case.
- Railway is paying Anthropic-related charges itself while it discusses them with Anthropic.
- OpenRouter is keeping its no-refund policy, so Railway is paying those charges. OpenRouter lets developers use many companies’ AI models through one account.
At least nine AI developer platforms reported incidents
Railway was not the only target. Cloud security company Wiz reported on Oct. 30 that at least nine AI developer platforms disclosed security incidents in October. Railway was one of them. These platforms are services developers use to build and run AI software. In some incidents, attackers targeted customers’ stored AI service keys.
Railway filed a complaint with the FBI
Railway filed a complaint with the FBI and is working with a specialist forensics firm, whose investigation is ongoing.
Railway says it fixed every security flaw the attacker used. It also says it gained access to Anthropic’s Project Glasswing, with U.S. Treasury Department approval. Through Glasswing, Anthropic gives a small group of vetted organizations access to unreleased Claude models for cybersecurity testing.
Railway says it will publish technical evidence of the attack, which security teams can use to check their own systems, once law enforcement approves.
