Railway says attackers hunting AI provider keys ran up about $740,000 in unauthorized usage
The cloud host's full incident report says the October intruder decrypted variables for at most about 100,000 workspaces and specifically queried for AI credentials, which Railway believes were resold for model distillation.
Why it matters
The report puts a number on a growing kind of attack: stealing paid AI access rather than customer data. Railway says the attacker queried variable names for AI provider keys and that the stolen keys later ran coding agents and training pipelines, consistent with services that resell access. It links the incident to similar thefts disclosed by OpenCode, Warp and Fireworks AI between 6 and 23 October. Refunds depend on each AI vendor's policy, and Railway says it will cover charges providers decline. Watch for attribution and provider changes to key monitoring.
Key facts
- Intruder detected on 20 October; report published 10 November
- At most 1.85% of workspaces, about 100,000, had variables decrypted
- Linked-account tokens of 1,852 users exposed and reset
- Estimated unauthorized spend: about $740,000
- Attacker specifically queried for AI provider credentials
- OpenCode, Warp and Fireworks AI disclosed similar thefts, 6 to 23 October