Railway: attackers ran up US$740,000 on its customers’ stolen AI keys
Railway’s incident report of 10 November: three weaknesses that took an attacker from a build to decrypted AI keys in a day, and who refunds the US$740,000.
An attacker who broke into Railway, the app-hosting platform, on 20 and 21 October decrypted customers’ AI provider keys, and unauthorised use of the stolen keys was estimated to reach about US$740,000, Railway said in its incident report of 10 November. Up to 1.85% of workspaces, about 100,000, could have had environment variables decrypted; Railway calls that an upper bound. The decrypted data also held linked-account tokens, agent keys customers had brought and GitHub sign-in tokens, for 1,852 users.1 Database logs show the attacker selecting variables whose names matched AI provider keys, and favouring customers with many variables.1
US$740k
estimated unauthorised spend on the stolen keys
Railway
≤100,000
workspaces (1.85%) whose variables could have been decrypted
Railway
1,852
users whose linked tokens were decrypted; all reset
Railway
353
build histories read on 20 October, sealed variables included
Railway
01Three weaknesses, one after another
A build escape, a wrong OIDC binding and a decryption key on disk led to customers' AI keys
The attack path in Railway's report, 07:28 UTC on 20 October to 07:14 UTC on 21 October 2026
- 01
Out of a build
20 Oct, 07:28: an unknown flaw let the attacker partly escape a shared build machine and read its credential. The internal job system accepted it as trusted, exposing other builds’ variables, and it fetched a copy of Railway’s code.
- 02
A wrongly scoped OIDC binding
21 Oct, 03:26: reading that code, the attacker found a misdefined OIDC binding in the deployment pipeline and took a short-lived cloud credential, then internal credentials and an SSH key.
- 03
A long-lived key on disk
An orchestration machine held, in a file, a longer-lived credential that could decrypt customer variables, and sat on the network of the database that stores them.
- 04
Decrypt the AI keys
04:07 to 07:14: encrypted variables pulled and decrypted, AI provider keys first. At 07:14 Railway disabled every cloud credential.
Source: Railway incident report, 10 November 2026 · as of 11 November 2026
The attacker had signed up dummy accounts from 18 October and was evicted at 09:24 UTC on 21 October, about 26 hours after the first exploit. Railway halted builds twice, invalidated every user session and token, and from 09:25 UTC on 21 October asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke keys, sending hashes of every key it held because it did not yet know which were exposed.1
02Who pays the US$740,000
Each provider has its own policy, as Railway lists them. AWS (Bedrock) and Google (Gemini) cover fraud under existing refund policies and have started refunds. OpenAI and SpaceXSI review claims case by case. OpenRouter is enforcing the no-refund policy in its terms, so Railway will cover those costs. With Anthropic, Railway is “in active discussions” and covers the cost of breached keys itself in the interim.1 Customers report charges through a form.1
Railway says OpenCode, Warp, Fireworks AI and others disclosed similar thefts between 6 and 23 October.1 Fireworks’ update of 9 November says its own breach reached more than it first reported: account and billing data and, for some accounts, secrets, datasets and unfinished models. It also describes a second way in: a third-party cloud provider hosting its research machines had an incident on 23 October, and the next day the intruder used it to reach Fireworks’ development machines.2 Notion cut Fireworks off by the morning of 3 November; on 8 November it learned that the data taken included Notion AI chat transcripts from under 1% of workspaces, mostly not attributable to a user or workspace.3
03What Railway changed
Each build now runs in its own short-lived virtual machine with a credential that can push only its own image. Only the secrets service can reach the keys that decrypt customer variables, every encrypt and decrypt is logged centrally, and service accounts were cut to what each workload needs, with short-lived credentials where possible.1
Sources
- Railway: Incident Report: October 21st Security Attack — 10 November 2026
- Fireworks AI: Update on October 2026 security incident — 9 November 2026
- Notion: Fireworks AI incident (security advisory) — 10 November 2026
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
