Stolen AI Keys From Railway Ran Up About $740,000 in Charges, and Railway Will Pay What Providers Won't

The hackers who broke into Railway in October were shopping for one thing: AI provider keys. They found enough of them to run up an estimated $740,000 in unauthorized usage, and the hosting platform now says it will cover the bills that AI providers refuse to refund.

That is a turnaround. In an October 26 update, Railway told customers it was unable to refund spending made with compromised keys. Its full incident report, published on Tuesday, promises to backstop the losses from its own balances for providers that will not pay.

Six and a half hours before anyone noticed

The attack started in Railway's build system, where several customers' builds shared the same virtual machine. At 07:28 UTC on October 20, the attacker used a previously unknown flaw to partly escape a build's filesystem isolation and read files on the host. That gave them a credential the build servers use to push finished images.

The credential was only meant for build work, but Railway's internal Temporal cluster accepted it as a trusted client. The attacker used it to read the stored histories of 353 builds, secrets included, and to pull a snapshot of the company's internal monorepo. Railway engineers only became aware of the intruder at 13:58 UTC.

Reading the code helped the attacker find the next door. At 03:26 UTC on October 21, they abused a wrongly configured OIDC binding in one of Railway's cloud environments to get a short-lived cloud credential. From there they took an SSH key to a fleet orchestration machine that held a credential able to decrypt customer variables.

Railway's logs show which environments were touched, not which variables, so its figure of at most 1.85% of workspaces, about 100,000, is an upper limit. The attacker was fully evicted at 09:24 UTC that day.

Who pays for the stolen tokens

Railway believes the attacker wanted AI keys to resell to relay services used for model distillation. The decrypted data also held linked-account tokens, BYOK agent keys and GitHub OAuth tokens, for 1,852 users. All were reset.

Refunds depend on the provider. AWS Bedrock and Google Gemini treat the charges as fraud and have started refunding. OpenAI and SpaceXSI review claims case by case. Talks with Anthropic are still going, and Railway is paying for breached Anthropic keys in the meantime. OpenRouter is sticking to its no-refund terms, so Railway says it will cover every OpenRouter cost tied to the breach.

The report does not explain how the $740,000 was estimated or what period it covers, and sets no cap or deadline for claims.

What changed

Every build now runs in its own short-lived virtual machine, on top of the old isolation, with a credential that can push only one specific image. Railway has filed a complaint with the FBI's IC3 and is working with a forensics firm whose investigation is still open.

The advice to customers has not changed since Railway told everyone to rotate every secret in October. Any sensitive variable stored before October 21 should be revoked at the provider that issued it, because filing a charge report with Railway does not kill the key. Railway is one of at least nine AI developer platforms that disclosed breaches in October, alongside Northflank.

Some offers on this page may be paid placements or contain affiliate links.