Railway says attacker stole secrets and incurred about $740,000 in charges
Original title: Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges
An upper limit of about 100,000 workspaces may have had environment variables decrypted; Railway reset 1,852 tokens.
Railway's November 10 report says an attacker used a previously unknown build-isolation flaw, an over-trusted credential and a faulty OpenID Connect trust setting to reach customer secrets. The first successful exploit was at 07:28 UTC on October 20. Railway says decrypted variables were an upper bound of 1.85% of workspaces, about 100,000, and estimates about $740,000 in unauthorized AI charges. It revoked credentials, rebuilt systems and restored builds by October 22, and says it will cover unreimbursed breach charges.
Unconfirmed: The workspace figure is an upper limit, and Railway has not established whether stolen keys were used for model distillation.
- The attacker read histories from 353 builds, including secrets.
- A bad OIDC trust setting exposed a short-lived cloud credential on October 21.
- Linked-account tokens for 1,852 users were reset.
- Railway found no account logins with stolen credentials and no customer database access.
- Customers should rotate exposed secrets and review provider usage.
Impact: Stolen customer secrets and about $740,000 in unauthorized AI charges
| Product | Affected |
|---|---|
| Railway | — |
- 1.Rotate potentially exposed secrets.
- 2.Review AI provider usage and report fraudulent charges.
From the original article
2 min read at cybersecuritynews.com
Railway has revealed how an attacker used AI agents, a build system flaw, and cloud access mistakes to steal customer secrets and generate an estimated $740,000 in unauthorized charges. Its November 10 report describes an attack that crossed several internal systems while engineers worked to close multiple entry points. The findings expand on the earlier […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.