Railway d all deployments yesterday after an attacker accessed customer environment variables — including live Anthropic and OpenAI API keys. If your app runs on Railway, stop reading after the first section and go rotate your secrets. If you want to understand why this keeps happening, the rest of this article is for you.
What Happened #
On October 21, Railway detected anomalous activity in the systems that store customer environment variables. An unauthorized party accessed those encrypted variables and, for some users, decrypted them. Environment variables on Railway routinely hold the keys to everything: AI provider credentials, database passwords, container registry tokens, Stripe keys. Railway’s official disclosure recommends rotating every secret stored on the platform immediately.
The crypto losses were confirmed quickly. Blockchain researcher Taylor Monahan traced roughly $371,000 drained from Railway customer wallets across 19 EVM chains — and the first theft transaction happened more than two hours before Railway went public with its disclosure. The platform d all deployments as part of its response, which created a painful Catch-22: rotating an exposed key requires a redeployment, but deployments were blocked. Apps were either running on possibly stolen credentials or fully down.
Postiz, a social scheduling tool that runs on Railway, shut down entirely after Anthropic and Stripe separately emailed that its API keys had been compromised. One Postiz engineer reported that AWS had already blocked over 3,000 requests made with stolen Claude credentials by the time they found out.
This Is a Campaign, Not an Incident #
Railway’s own disclosure states the intrusion is likely “part of a broader campaign against platform companies, with the goal of compromising AI inference providers.” That phrasing is important. They are not describing a targeted attack on Railway. They are describing Railway as one casualty in an ongoing series.
October 2026 has seen at least 14 significant platform security incidents. Fireworks AI disclosed a breach on October 9 — unauthorized access to customer environment variables in AI evaluation jobs. OpenCode Console was breached October 16–17, exposing OpenAI, Anthropic, and Google API keys for approximately 1.4% of users, with victims reporting individual losses of hundreds to thousands of dollars from unauthorized inference charges. LiteLLM’s PyPI package was compromised on October 21 — the same day as Railway. In every case, the target was AI provider credentials.
Why AI Keys Are Worth More Than Your Database Password #
Developer Theo Browne laid out the economics clearly after the Railway disclosure: the labs’ aggressive stance against model distillation has created a market for stolen API keys. A stolen Anthropic or OpenAI key delivers a few hundred to a few thousand dollars of inference before it gets revoked. That is enough compute to generate training data that cannot be obtained by scraping — frontier model outputs, reasoning traces, chain-of-thought examples. The data then feeds into training runs for competing models.
This is not random opportunism. There is a standing demand, a price per key, and a distribution network. Platforms that hold customer secrets — every PaaS, every cloud deployment tool, every CI/CD system with stored environment variables — are now high-value targets in this supply chain.
What You Need to Do Right Now #
If you have ever stored AI provider credentials on Railway, rotate them immediately regardless of whether you were notified. Do not wait for Railway’s post-mortem. Rotate your Anthropic, OpenAI, OpenRouter, Google, Mistral, and any other AI provider keys now. Also rotate database passwords, Stripe keys, registry credentials, and any other secrets stored on the platform. Railway invalidated all Railway API tokens on October 22, so update those as well. Check your provider dashboards and logs for unexpected usage spikes before the keys were rotated.
For the structural problem: environment variables injected by a PaaS are a convenience, not a security boundary. If you are building anything that uses AI inference in production, your provider keys should live in a dedicated secrets manager — [Infisical, Doppler, or HashiCorp Vault](https://infisical.com/blog/secrets-management-complete-guide) — not in platform env vars. Use separate keys for each environment, so a staging compromise does not touch production. Automate rotation so that a compromise can be remediated in minutes, not hours.
This Is Not Slowing Down #
The Railway breach is the most visible incident in a campaign that has been running for weeks. The economic incentive — distillation-grade inference from frontier models — is not going away, and the attack surface keeps growing: every new PaaS deployment, every new CI/CD integration, every new AI agent storing provider credentials is another target. GitGuardian’s analysis of the incident recommends treating every environment variable as exposed until proven otherwise. The question is not whether your platform will be targeted but whether your secret management strategy will survive it when it is.