Railway, a cloud hosting service, disclosed a 26-hour security incident where attackers exploited AI provider credentials, generating roughly $740,000 in unauthorized AI service charges and potentially accessing up to 100,000 workspace accounts.
On October 22, Railway disclosed a security incident and followed up with a detailed report this week. Due to an ongoing investigation, Railway cannot reveal specific details or the full extent of the exploits. However, they advised users to reset sensitive environmental variables stored on their platform before October 21.
David Shipley from Beauceron Security warned that AI credentials are increasingly valuable, akin to credit card numbers. He predicts that ‘LLMjacking’ will surpass cryptojacking as a profitable and scalable attack method. Attackers exploited an unknown vulnerability in Railway’s build system to steal an internal credential.
The attackers further exploited a misconfigured trust relationship, gaining deeper access to Railway’s infrastructure. This allowed them to obtain credentials used to decrypt customer environment variables. They combined multiple exploits, moved laterally across systems, and simultaneously explored various attack routes.
Attackers Gain Deep Access
Railway’s engineering team worked 24-7 in shifts to counter the attack, which became a contest of agent speed. The threat actors were fully evicted on October 21, but over the course of their time in the system, they obtained and decrypted a subset of customer variables, roughly 100,000, or at most 1.85% of workspaces.
The breach exposed linked-account tokens of over 1,850 users, including GitHub and OAuth tokens, which Railway reset. They collaborated with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke compromised keys. Railway is also reimbursing customers for charges that providers won’t refund.
Read Also: Malware turns Exchange servers into spy hubs
Following the attack, customers were advised to restrict public access to databases, rotate sensitive variables and keys, review GitHub account activity, and check audit logs in registries like Dockerhub. Railway disabled compromised internal tools and renewed all keys after confirming the intruders were removed.
Value of Stolen AI Keys
Frank Dickson of Dickson Research explained that training models at scale requires millions of questions, which can be flagged if coming from a single account. Stolen keys distribute these queries across many accounts, making them valuable for tasks like distillation, which transfers knowledge between models to reduce costs.
Railway is now moving to short-lived credentials and logging every decryption, a move Dickson endorses. He noted that “Railway customers should treat every secret stored on the platform as stolen until they have rotated it.” However, that rotation has to beat the thief’s clock; an investigation by Wiz found that stolen keys were tested within 30 minutes of theft, then flooded with traffic four to seven days later.
Start with AI provider keys, then rotate cloud, database, and payment credentials, he advised. Check AI provider bills and usage logs for traffic internal teams did not generate, then report any unauthorized charges to Railway. Alert on any call from an unrecognized address. Further, he said, limit the damage any one key can do.
Set hard spending caps and usage alerts on every AI key, and scope each key as narrowly as the provider allows. This really works: In one case Wiz examined, a key restricted to a narrow set of model profiles left most of the thief’s traffic throttled. Non-Railway users, meanwhile, should ask their platform providers two questions: How are my secrets stored, and who can decrypt them?
A good standard practice: Issue fewer keys. “No one ever said during a key rotation that they wished they had issued more keys,” Dickson pointed out. Ultimately, he said, a stolen AI key spends real money, and machines now hold most of the keys. “Protect machine identities like cash, because to a thief, that is exactly what they are,” Dickson urged.
