Railway Breach Exposes 100,000 Workspaces, Generates $740,000 in Fraudulent AI Charges

Railway Breach Exposes Massive Security Vulnerabilities in Cloud Infrastructure

Cloud hosting provider Railway disclosed a significant cybersecurity breach that resulted in approximately $740,000 in fraudulent AI charges after attackers exploited zero-day vulnerabilities in its build infrastructure1

1

. The attack, which began on October 20 and lasted roughly 26 hours, potentially exposed decrypted environment variables for up to 100,000 customer workspaces, representing at most 1.85% of Railway's total infrastructure2

2

. Railway emphasized this figure represents the maximum number of potentially impacted workspaces rather than confirmed compromises.

How Attackers Exploited the Filesystem Isolation Flaw

The Railway breach started at 07:28 UTC on October 20 when threat actors exploited a previously unknown vulnerability to partially escape filesystem isolation and read files on host virtual machines3

3

. This initial access granted attackers an internal credential that build servers use to authenticate to Railway's systems. The on-call engineer received alerts about six and a half hours later at 13:58 UTC when unusual calls to a registry service were detected2

2

. Using this credential, attackers accessed Railway's internal Temporal system and retrieved cached snapshots of the company's source code, which they analyzed to identify additional exploitation routes.

Stolen Customer AI Keys Fuel Unauthorized Usage

The attackers exploited a second vulnerability involving an improperly configured trust relationship to obtain credentials used to decrypt customer environment variables1

1

. Railway's investigation revealed that attackers specifically searched for AI provider keys, though some queries also targeted cloud credentials, database credentials, and payment service credentials. The stolen API keys were subsequently used to access paid AI services across multiple platforms including OpenAI, Anthropic, AWS Bedrock, Google Gemini, SpaceXSI, and OpenRouter, generating the estimated $740,000 in unauthorized AI usage charges2

2

.

The 26-Hour Battle Between AI-Powered Agents

What distinguished this cloud hosting provider breach was the unprecedented nature of the attack itself. Railway described the incident as a 26-hour battle between its engineers and threat actors using AI-powered agents to identify and exploit vulnerabilities across its infrastructure in parallel1

1

. According to Wiz, the escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX3

3

. This was not a single breach followed by a single fix, but rather attackers probing many potential routes simultaneously while defenders worked to harden systems in real-time.

Credential Theft Extends Beyond AI Provider Keys

The Railway breach also exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys1

1

. Railway reset all affected tokens and notified impacted users. Additionally, attackers read stored histories of 353 builds, including variables and secrets passed to those builds2

2

. However, Railway found no evidence that attackers downloaded customer Git repositories or accessed customer databases during the intrusion.

Railway Commits to Reimburse Customers for Fraudulent Charges

Railway announced it is working with affected AI providers to reimburse customers for the unauthorized AI usage charges and will cover costs that providers decline to refund1

1

. Refund terms differ by provider: AWS Bedrock and Google Gemini are processing refunds under existing fraud policies, while OpenAI and SpaceXSI review cases individually2

2

. Railway will cover all costs from breached Anthropic keys during ongoing negotiations and all OpenRouter-related costs, as that provider maintains a no-refund policy.

Connection to Black October Campaign Targeting AI Platforms

Railway believes the attackers focused on stealing AI credentials for resale or use in large-scale model training and model distillation, linking the incident to a recent wave of attacks security firm Wiz dubbed "Black October"1

1

. This campaign has targeted numerous AI development platforms during October, including Northflank, OpenCode, Warp, and Lightning AI1

1

. Model distillation involves training smaller AI models to imitate larger, more powerful ones by sending numerous queries and using responses as training data, which analysts believe may explain how some models compete despite resource constraints3

3

.

What Railway Customers Should Do Now

Railway advises customers to revoke and rotate any sensitive variable stored on the platform before October 21, when attackers were fully removed from systems2

2

. Customers should rotate keys with the provider that issued them, as filing a charge report does not automatically revoke compromised API keys. Additional recommendations include removing public network access to databases, checking GitHub audit logs and authorized applications, and reviewing audit logs in container registries like Docker Hub. Out of caution, Railway provided some providers with every key it held for their services, meaning reset requests reached more than 100,000 users, though a revocation notice doesn't necessarily confirm exposure2

2

. Railway confirmed all exploited vulnerabilities have been remediated and rebuilt affected infrastructure.