Railway says attackers stole customer secrets and ran up about $740,000 in AI charges

Railway, a cloud hosting provider, says hackers used two vulnerabilities in its own infrastructure to reach decrypted customer environment variables and then spent the credentials on AI services, running up approximately $740,000 in fraudulent usage. The company published its incident report on November 10, after first disclosing the incident on October 22 and telling customers to rotate secrets.

What happened

The attack started on October 20. According to Railway, the intruders exploited a previously unknown flaw in the build infrastructure to escape filesystem isolation and pick up an internal credential. With that, they read stored build histories and pulled a copy of Railway's internal source code, then went through it looking for more ways in.

A second flaw, described as an improperly configured trust relationship, got them further into the infrastructure and to the credentials used to decrypt customer environment variables. Railway says the attackers were fully removed on October 21 and that all exploited vulnerabilities have since been remediated.

The company puts the exposure at most 1.85% of its workspaces, or approximately 100,000, and is explicit that this is a ceiling rather than a confirmed count of workspaces whose secrets were taken. Linked-account tokens for 1,852 users, including GitHub OAuth tokens and AI agent keys, were also exposed; Railway says it reset those and notified the people affected.

Railway says it found no evidence that customer Git repositories were downloaded or customer databases accessed.

The mechanism, and what it says about the target

Two things stand out in the report. The first is the order of operations: a build-system escape, then source code, then a trust misconfiguration. Reading your own platform's source is a cheap way to find the second bug, and it means the first foothold was worth more than a single credential.

The second is what the attackers were after. Railway says they specifically searched for AI provider credentials, with some queries also aimed at cloud, database and payment service credentials. The stolen secrets were then used to generate the AI charges. Railway believes the goal was resale or use in AI model distillation, and links the incident to a run of attacks on AI developer platforms that Wiz has named "Black October", citing Northflank, OpenCode, Warp and Lightning AI among the targets.

Railway describes the response as a roughly 26-hour contest, with attackers probing many routes in parallel while its engineers hardened them in parallel. Its report calls it "a contest of agent speed", and the article attributes to Wiz the description of abliterated models and a harness similar to ARTEX on the attacking side. That framing comes from the company and a security firm, not from anything independently published.

HackZoneLabs assessment

The dollar figure is the least interesting part. $740,000 in AI usage is a bill, and Railway says it's working with providers to reimburse customers and will cover what they decline to refund. The part worth taking seriously is that the thing stolen was a class of credential most teams treat as low-stakes: an API key in an environment variable, sitting in a build system, readable by anything that can break out of a container.

In our view, the 1.85% ceiling is the number to hold onto, and it cuts both ways. It's a small slice of the customer base, and Railway hasn't said how many of those workspaces actually had secrets lifted. Both statements can be true at once, and the report doesn't resolve which. We'd treat the silence on confirmed theft as a gap, not a reassurance.

The "agent speed" framing deserves some caution too. It's the company's characterisation of its own incident, and it's a flattering one: a fast, automated adversary explains a messy 26 hours. It may well be accurate. Nobody outside Railway has published a write-up of the vulnerabilities, so the claim that the flaws were novel and are now fixed rests on the vendor's word.

What remains unknown

Railway hasn't said how many workspaces had secrets actually taken, only the maximum. It hasn't described either vulnerability in technical detail, so there's nothing to check your own build isolation or trust configuration against. Whether the "Black October" link is a shared actor or a shared playbook is also unresolved; the article reports Railway's belief and Wiz's naming, not a confirmed attribution.

For defenders, the supported step is the one Railway already asked for: rotate secrets that lived in environment variables, and check what those credentials could reach. AI provider keys are worth an explicit look, since that's what the attackers went hunting for. If a key was used, the provider's usage logs are where the evidence will be.