Railway Reports $740,000 Fraudulent AI Charges Due to Security Breach

Cloud hosting provider Railway reported that hackers exploited vulnerabilities in its infrastructure, resulting in approximately $740,000 in fraudulent AI usage and potentially exposing credentials for up to 100,000 workspaces.

The company disclosed the incident on October 22, warning customers to rotate their secrets after detecting unauthorized access to systems storing environment variables.

In a new incident report published on November 10, Railway confirmed that attackers accessed its internal source code and decrypted customer environment variables for at most 1.85% of its workspaces, which equates to around 100,000.

This figure represents the maximum number of potentially impacted workspaces, rather than the confirmed number of secrets stolen.

The attack began on October 20, when hackers exploited a previously unknown vulnerability in Railway’s build infrastructure to escape filesystem isolation and obtain an internal credential.

The attackers used this credential to access stored build histories and retrieve a copy of Railway’s internal source code, which they analyzed to identify additional ways to compromise the platform.

Subsequently, they exploited a second vulnerability involving an improperly configured trust relationship to gain further access to Railway’s infrastructure and obtain credentials used to decrypt customer environment variables.

Railway described the incident as a roughly 26-hour battle between its engineers and the attackers, who utilized AI-powered agents to identify and exploit vulnerabilities across the infrastructure while Railway’s defenders worked to secure the systems.

“This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel,” Railway stated.

The company noted that the escalating situation became a contest of agent speed, with Railway defending against compromised models and a harness similar to ARTEX, according to security firm Wiz.

Railway’s investigation revealed that the attackers specifically searched for AI provider credentials, although some queries also targeted cloud, database, and payment service credentials.

The stolen credentials were used to generate approximately $740,000 in unauthorized AI usage, and Railway is working with affected providers to reimburse customers. The company stated it would cover charges that providers decline to refund.

The breach also exposed linked-account tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys. Railway has reset those tokens and notified affected users.

Railway believes the attackers aimed to steal AI credentials for resale or use in AI model distillation, linking the incident to a recent wave of attacks against AI developer platforms, which security firm Wiz has dubbed “Black October.”

This campaign has targeted numerous AI development platforms over the past month, including Northflank, OpenCode, Warp, and Lightning AI.

Railway confirmed that the attackers were fully removed from its systems on October 21 and that all exploited vulnerabilities have since been remediated.

The company also found no evidence that the hackers downloaded customer Git repositories or accessed customer databases.

Source: BleepingComputer