Railway Says Hackers Used Two Flaws to Steal Secrets and Run Up $740K in AI Charges

Cloud hosting provider Railway has disclosed a security incident in which intruders exploited two vulnerabilities to reach internal systems and customer authentication material, then used stolen credentials to generate about $740,000 in unauthorized AI usage, BleepingComputer reports.

Railway first warned customers on Oct. 22 to rotate secrets after it found unauthorized access to systems that store environment variables. In a follow-up incident report, Railway said attackers reached its internal source code and decrypted customer environment variables for at most 1.85% of workspaces—roughly 100,000. Railway described that figure as the maximum number of workspaces potentially affected, not a confirmed count of customers whose secrets were taken. The distinction matters because the disclosure establishes an upper boundary, not the actual scope of credential theft.

According to Railway's account, the intrusion began Oct. 20. Attackers used an unknown flaw in the build infrastructure to escape filesystem isolation and obtain an internal credential. They then accessed build histories and retrieved a copy of Railway's internal source code, which they studied for additional paths into the platform. A second flaw—a misconfigured trust relationship—gave them deeper access and credentials needed to decrypt customer environment variables.

Railway characterized the response as a roughly 26-hour contest between its engineers and attackers using AI-powered agents to probe and exploit infrastructure. The company said the event was not one breach followed by one fix: attackers tried many routes in parallel while defenders hardened systems at the same time. Railway also said the attackers specifically looked for AI provider credentials, while some searches also targeted cloud, database and payment-service credentials.

The stolen credentials were used for approximately $740,000 in unauthorized AI usage. Railway said it is working with affected providers to reimburse customers and will cover charges that providers decline to refund. The breach also exposed linked-account tokens for 1,852 users, including GitHub OAuth tokens and AI agent keys. Railway said it reset those tokens and notified affected users.

Railway believes the attackers were after AI credentials for resale or use in model distillation, and it linked the incident to a recent campaign against AI developer platforms that Wiz has called “Black October.” BleepingComputer reports that the campaign has hit several AI development platforms in the past month, including Northflank, OpenCode, Warp and Lightning AI. That attribution and motive are Railway's assessment, not an independently established fact in the source material.

On remediation, Railway said the attackers were removed from its systems on Oct. 21 and that all exploited vulnerabilities have been fixed. It also said it found no evidence that hackers downloaded customer Git repositories or accessed customer databases. Those are company findings; the source does not include independent technical confirmation. Affected customers should follow Railway's notices, rotate any secrets the company flagged, and review linked OAuth and agent-key access, especially where those credentials could authorize paid AI services.