Railway says an attacker hunting AI keys ran up an estimated $740,000 on stolen credentials

Railway believes the keys were bound for model distillation, and it'll pay the bills some AI providers won't refund.

By Think Facility · November 11, 2026 · AI security AI industry

On November 10, 2026, Railway, a platform developers use to build and deploy apps, published its full report on the attack it suffered in October. It says the attacker got in at 07:28 UTC on October 20 through a flaw in its build system, and wasn't fully out until 09:24 UTC the next day.

The target was AI keys. Railway says the attacker's database queries went looking for AI provider credentials by name, and it estimates unauthorized spend on the stolen keys at about $740,000.

Who: Railway
Attack: 07:28 UTC on October 20th to 09:24 UTC on October 21st
Workspaces exposed: at most 1.85% (~100,000)
Linked-account tokens: 1,852 users
Unauthorized spend: ~$740,000

How the attacker got in

Railway ran several builds side by side on one virtual machine, each supposedly isolated. The attacker found a flaw that let a build partly escape, took a credential the build servers use, and read the stored histories of 353 other builds with it. The same credential let them fetch a copy of Railway's internal monorepo, which holds much of its own code.

Reading that code, they found a misconfigured OIDC binding in one of Railway's cloud environments and used it at 03:26 UTC on October 21. That led to a machine holding a key that could decrypt customer variables. They decrypted some in two windows that morning, until Railway disabled the credential at 07:14 UTC.

Database logs show that the attacker was specifically prioritizing AI provider keys in their queries

From Incident Report: October 21st Security Attack | Railway Blog

Railway describes the fight as "a contest of agent speed" against abliterated models and, according to Wiz, a harness similar to ARTEX, the hacking agent we've written about in several earlier attacks.

Where the keys went

Railway believes the keys were passed on to "distributed transfer stations for use for distillation." Distillation means training one model on another's answers, and with a stolen key someone else pays for them.

The misuse customers reported back ranged from coding-agent requests to reviews of AI-agent behavior collected as training data. Railway says that mix fits credentials being handed out through services that relay or resell AI access, but it hasn't established whether the attacker ran those services.

Wiz's researchers have been tracking what they call Black October. Their list has at least nine AI developer platforms disclosing incidents in October, from Fireworks AI on October 6 to Northflank on October 30, with more added since. One of them, Zeabur, is shutting down.

At list price, these two cases alone likely ran up over $100k in usage

From “Black October” for AI Developer Platforms | Wiz Blog

Those two cases are enterprise keys Wiz watched being abused after a vendor breach. One key made about 800,000 Bedrock calls over thirty hours; the other, about 1.7 million in thirteen. Wiz tied permission checks on both keys to two sites selling cut-price access to frontier models. The first test call on each asked for Claude Fable 5.1, failed, and fell back to Opus 5.5.

Who pays for a stolen key

For the developers whose keys leaked, this is a billing problem first. Whoever holds an AI key can run up usage that the key's owner is charged for. Railway is asking customers to report charges they didn't make, and what happens next depends on whose key it was.

AWS Bedrock: refund policy covers fraud
Google Gemini: refund policy covers fraud
OpenAI: refunds reviewed case-by-case
Anthropic: active discussions; Railway covering costs
OpenRouter: no-refund policy; Railway covering costs

Railway says it'll cover token losses itself wherever a provider won't. If you're a Railway customer with an OpenRouter bill, that's the line to read: OpenRouter is holding to its terms, so the money comes from Railway.

Wiz also collected unconfirmed reports from social media, including consumer bills in the hundreds to thousands of dollars from abused OpenCode access and an alleged theft of about $371,000 in cryptocurrency using keys stored on Railway. Railway's report doesn't mention the crypto theft.

What Railway changed

Each build now gets its own short-lived virtual machine, and only Railway's secrets service can reach the keys that unlock customer data. Railway also says it now has access to Project Glasswing, with approval from the U.S. Department of the Treasury, which it had asked for before the attack.

Railway sent a formal complaint to the FBI's IC3 during the response. It says it'll publish its indicators of compromise once law enforcement signs off.