Railway Breach Exposes Customer Secrets, Leads to $740,000 AI Fraud

Cloud hosting provider Railway has disclosed a security breach that led to the theft of customer authentication secrets and approximately $740,000 in fraudulent AI usage. The incident, which Railway described in a new report, potentially exposed credentials for up to 100,000 workspaces.

The attack began on 20 October, exploiting a previously unknown vulnerability within Railway’s build infrastructure. Attackers managed to escape filesystem isolation, gaining an internal credential that allowed them to access stored build histories and copy Railway’s internal source code.

Attackers Used AI Agents to Identify Vulnerabilities

After acquiring the source code, the attackers analysed it to find additional weaknesses. They then exploited a second vulnerability, stemming from a misconfigured trust relationship, to gain deeper access and obtain credentials used to decrypt customer environment variables.

Railway characterised the incident as a 26-hour confrontation, with its engineers battling threat actors who were actively using AI-powered agents to identify and exploit vulnerabilities across its infrastructure. Security firm Wiz noted that the attackers’ methods involved ‘abliterated models and a harness similar to ARTEX’.

The company confirmed that the attackers specifically sought credentials for AI providers, although some queries also targeted cloud, database, and payment services. The stolen credentials were subsequently used to generate substantial unauthorised charges, amounting to an estimated $740,000, which Railway is working with affected providers to reimburse. The company has pledged to cover any charges that providers decline to refund.

The breach also compromised linked-account tokens for 1,852 users, including GitHub OAuth tokens and AI agent keys. Railway has since reset these tokens and notified all affected users.

Linked to Broader ‘Black October’ Campaign

Railway believes the primary motive behind the attack was to steal AI credentials for resale or use in AI model distillation. The incident has been linked to a wave of attacks against AI developer platforms, a campaign security firm Wiz has named ‘Black October’. This ongoing campaign has targeted several AI development platforms, including Northflank, OpenCode, Warp, and Lightning AI, over the past month.

Railway stated that the attackers were fully removed from its systems on 21 October, and all exploited vulnerabilities have been remediated. The company also found no evidence that the hackers downloaded customer Git repositories or accessed customer databases. Customers were initially advised to rotate their secrets following the detection of unauthorised access on 22 October.