Security: AI armed hackers stole Railway's AI keys, who pays the $740,000?

Twenty-six hours of fighting. On October 20 and 21, hackers armed with AI agents fought against the engineers at Railway, an American hosting provider, that is, a company that rents out servers where developers put their applications so they can run on the Internet. The hackers opened doors, the engineers closed them, and the hackers opened three more at the same time. In the end, they left with the AI keys of thousands of customers, and those keys were used to consume around $740,000 worth of AI. On someone else's tab, obviously! Railway published its full report on Tuesday, November 10, hour by hour.

The reception desk's key board, after the hackers came through

Twenty-six hours of whack-a-mole

On Saturday, October 18, someone creates fake accounts at Railway and starts testing the waters. Nothing gets through. On Monday the 20th, at 9:28 a.m. Brussels time, it works: an as-yet unknown flaw in the machines that prepare customers' applications lets him get out of his little box and get his hands on an internal password. With it, he reads the history of 353 application builds belonging to other customers, and leaves with a copy of Railway's own code.

And that's when it gets really scary. With this code in his hands, the attacker was able, I quote the report, to “launch his agents in a fan, find any vulnerability, and move laterally”. In plain English: he unleashed a pack of AI agents on the house plan, each one looking for a different door, at the same time. And his agents were running on “uncensored” models, AIs with their guardrails removed, the ones that never say “sorry, I can't help you hack this server”.

Railway blocked one door, the attacker's agents tried three others in parallel

Railway sums it up in a sentence that I find terrifying: “the situation became a speed race between agents”. A second mistake, a simple misconfiguration in the way two internal systems trust each other, gave the attacker what he needed to decrypt the customers' secrets. The alarm went off six and a half hours after the first intrusion. The attacker was not thrown out for good until Tuesday the 21st at 11:24 a.m. Twenty-six hours, plugging holes while others opened elsewhere. I wouldn't have wanted to be on call that day!

What they were looking for: your AI keys

The most interesting part is what the attacker looked for once he was in the vault. Not the customers' databases (Railway found no trace that he had touched them), not their code. He searched through the stored secrets, with a list of words to look for, and his number one target was AI keys: those long strings of characters that tell OpenAI, Anthropic or Google “I'm the one paying for everything this program asks for”. An AI key is a bank card without a PIN, and I had already talked about it three weeks earlier when OpenCode had its own emptied out.

At most, 1.85% of Railway's workspaces are affected, around 100,000 of them. That's a ceiling, not an exact count: Railway's logs say which projects were opened, not which keys were read. The linked accounts of 1,852 users were also reset as a precaution. And according to Railway, the stolen keys were resold, then used for anything and everything, from programming assistants to training other AIs.

OpenCode, Railway, and it's not over. The security company Wiz has given this wave a name, “Black October”: at least nine platforms for developers hacked in one month, all for the same thing, the AI keys stored there. In one of the cases studied by Wiz, a single stolen key was used for around 800,000 requests in thirty hours, three quarters of them on Opus, one of Anthropic's big models, far from the cheapest. When someone else is paying, you don't order from the kids' menu!

Who pays the $740,000?

About 740,000 dollars' worth of AI consumed with stolen keys

Good news all the same: not the customers, in principle. And that's where the report becomes instructive, because each AI provider reacts in its own way. Amazon (for its Bedrock service) and Google issue refunds, they already have a policy for this kind of fraud. At OpenAI, the customer opens a request and they study the case. At Anthropic, discussions are ongoing. And OpenRouter, a service that resells access to loads of different models, applies its house rule: no refunds. Railway announced that it would pay out of its own pocket for everything the providers refuse to refund.

I applaud that. Railway could have published three vague lines about « a security incident » and moved on. They put out a report with every hour, every error, and even what they should have done differently: they acknowledge that they warned the AI providers before their own customers, and promise not to wait so long again. Not all hacked companies do as much, far from it.

And does it affect you?

If you're not a developer, you've probably never heard of Railway. But your hairdresser's little booking site, your health insurer's chatbot or the app for the bakery down the street may be running on a host of this kind, with an AI key tucked away somewhere. Here, according to Railway, no customer database was opened: it was mostly the companies' wallets that took the hit.

If, on the other hand, you have an AI key yourself, even for a small use, the fix comes down to one setting: the spending cap. At Anthropic, you set a maximum amount per month in your console. At OpenAI, the simplest option is to pay with prepaid credits without automatic top-ups: credit used up, nothing else goes through. The thief can still use your key, but hits the cap dead-on, like a gas pump set to 50 euros. I have an OpenAI key that makes the images for this blog, and it lives on my server, not with a host of this kind. That doesn't make me invulnerable either, and that's exactly why the cap exists.

A spending cap is like a pump set to 50 euros: even with your key, the thief can't go any further

And if you learn that one of your keys has leaked, deleting it at the host is useless. You have to revoke it where it was created, at OpenAI, Anthropic or Google: that's the only way to cut off the card.

If you're a developer

You can skip this part if the words « environment variable » mean nothing to you. For everyone else, here's what I take away from the report.

If you deployed at Railway, follow their guides: change all your secrets, reconnect GitHub, recreate your CLI and CI tokens, then redeploy your latest commit. And if an unfamiliar AI bill is sitting on your account, report it using the report's form, Railway has committed to paying.

Then there's the rule everyone forgets: you revoke a key with whoever issued it. Deleting the variable on Railway, Vercel or elsewhere is throwing away your copy of the key. The thief keeps theirs, and it still works at OpenAI or Anthropic.

One key per project, one cap per key, and tokens that expire quickly when the provider allows it. The goal isn't to prevent theft, it's for a stolen key to be worth almost nothing.

The attacker's second door was a poorly defined OIDC connection, that mechanism which allows your deployment chain to prove who it is to the cloud without storing a password. If you use it, reread your trust conditions (repository, branch, token subject). One condition that's too broad, and any well-formed token gets through the door as if it belonged there.

On the application-building side, Railway now gives each build its own disposable virtual machine, which is only allowed to push a single image. If you run strangers' code on your build machines, that's the model to aim for. Otherwise, one day, a stranger reads your secrets with your own machines. And he doesn't say thank you.

What still sticks in my craw

What struck me most was not the amount. It was the duel. We've been talking for months about AI agents that find vulnerabilities, and I've written about it often here, generally on the side of the good guys who use them to fix things. There, we saw the other side, for real, for twenty-six hours: an attacker reading his victim's code with a pack of agents that never sleep, facing a human team taking turns and wondering where it was going to pop up next. Nine platforms in one month, and I'm just wondering which one will be the tenth, and whether I use it.

Sources

• Railway, November 10, 2026: full incident report on the attack of October 20 and 21 (in English)
• BleepingComputer: the breach at Railway cost $740,000 in fraudulent AI charges (in English)
• Cloud Security Alliance: Black October, the wave of hacks targeting AI developer platforms (in English)

Article written with the help of Claude Code, proofread and corrected by me.