Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges

Railway has revealed how an attacker used AI agents, a build system flaw, and cloud access mistakes to steal customer secrets and generate an estimated $740,000 in unauthorized charges. Its November 10 report describes an attack that crossed several internal systems while engineers worked to close multiple entry points.

The findings expand on the earlier Railway security incident disclosure. Up to 1.85% of workspaces, roughly 100,000, could have had environment variables decrypted. This is an upper limit, not a confirmed count of workspaces with stolen keys, because available logs identify affected environments rather than individual secrets.

The first successful exploit occurred at 07:28 UTC on October 20. A previously unknown flaw let the attacker partially escape the build system’s file isolation and read files on its host machine. Those files exposed a credential that build servers used to access internal services and push completed images.

That credential carried more trust than intended. Railway’s Temporal task system accepted it, allowing the attacker to read stored histories from 353 builds, including secrets. Access to cached repository snapshots also exposed Railway’s internal codebase, giving AI agents a map to search for weaknesses and test several routes at once.

Railway said the attacker used models with safety limits removed through an agent framework similar to ARTEX. Engineers detected unusual registry API calls at 13:58 UTC and later replaced the stolen credential. However, the copied codebase helped the attacker find another route after Railway blocked the initial entry point.

Cloud Trust Error Exposed Encrypted Secrets

According to Railway’s detailed incident report, an incorrect OpenID Connect, or OIDC, trust configuration exposed a short-lived cloud credential at 03:26 UTC on October 21. The attacker used it to retrieve internal credentials and an SSH private key, then entered a machine responsible for coordinating customer workloads.

That machine had network access to the production database and another credential able to authorize secret decryption. The attacker retrieved encrypted variables and used Railway’s key management service to decrypt some values. This was credential abuse, not evidence of broken encryption. Database queries specifically searched for AI provider key names.

Railway believes stolen keys reached services that relay or resell AI access, potentially supporting model distillation. However, it has not established whether the intruder operated those services. Wiz’s “Black October” investigation documents the wider credential theft pattern but does not independently attribute the Railway breach.

The stolen data included linked-account tokens for 1,852 users, which Railway reset. Investigators found no Railway account logins using stolen credentials and no evidence of customer database access. The resulting charges reflect LLMjacking attacks, where criminals use stolen credentials to consume paid AI services at victims’ expense. Railway estimated unauthorized spending reached approximately $740,000.

Railway revoked credentials, rebuilt internal systems, and restored builds for every plan by October 22. Its preliminary report outlined immediate recovery steps. Customers should rotate potentially exposed secrets, review provider usage, and report fraudulent charges.

Railway says it is working with providers on refunds and will cover breach-related charges where providers decline reimbursement, rather than leaving affected customers to absorb those losses.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges appeared first on Cyber Security News.