Railway Post-Mortem: AI Agents Stole $740k in API Keys

Railway disclosed that an attacker escaped its build system on October 20, spent 26 hours using autonomous AI agents to hunt for AI provider credentials, and exfiltrated decrypted environment variables from up to 100,000 customer workspaces, producing $740,000 in fraudulent charges — double the figure in Railway's initial October 22 alert. Railway's post-mortem says the intruder chained three flaws — a build-system zero-day for container escape, a misconfigured OIDC trust relationship for privilege escalation, and access to the internal key management service — pulling the encrypted variable store between 04:07 and 05:21 UTC on October 21 and decrypting it until 07:15 UTC, before engineers evicted the attacker at 09:24 UTC. Wiz Research, which tracks what it calls "Black October," counts at least nine AI developer and cloud hosting platforms disclosing credential breaches in October 2026, including Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Warp, CommandCode and Northflank, with November adding Brev, Trigger.dev, Chainstack, RunPod, Blacksmith, Tensorlake and NEAR AI.

Railway’s full post-mortem is out, and it’s worse than the initial disclosure. An attacker broke out of the platform’s build system on October 20, spent 26 hours hunting for AI provider credentials using autonomous AI agents, and left with decrypted environment variables from up to 100,000 customer workspaces. The fraudulent charges: $740,000 — double the figure Railway released in its initial October 22 alert https://byteiota.com/railway-breach-rotate-your-ai-api-keys-now/ . If your Railway API keys haven’t been rotated, consider them burned. How the Attack Worked The attacker didn’t get in through phishing or a leaked password. They chained three separate vulnerabilities over 26 hours. At 07:28 UTC on October 20, they exploited a zero-day in Railway’s build system to partially escape container filesystem isolation, gaining read access to host VM files and the build server credentials stored there. Six hours later, Railway’s on-call team got the alert. By then it was already too late to prevent the second stage. At 03:26 UTC on October 21, the attacker pivoted using a misconfigured OIDC trust relationship to escalate privileges further. From there, they accessed Railway’s internal key management service — the system that holds the decryption keys for customer environment variables. Between 04:07 and 05:21 UTC, they pulled the encrypted variable store from the database. Between 04:42 and 07:15, they ran decryption. Railway engineers evicted the attacker at 09:24 UTC. Three flaws, chained. Build isolation, identity trust, and secrets access — each one a gap that individually might look acceptable, together catastrophic. AI Agents on Both Sides of the Attack The post-mortem’s most striking detail: the attackers didn’t do this manually. Railway describes the breach as “a 26-hour battle between its engineers and threat actors using AI-powered agents.” The attackers used autonomous agents with safety limits removed — reportedly via a framework similar to ARTEX — to scan decrypted environment variables, classify credentials by type, and route AI provider keys to external infrastructure for immediate exploitation. The meta-layer here is hard to ignore. Attackers built AI agents to steal the API keys that developers use to build AI agents. The stolen credentials were then used to run inference at victim expense, generate model distillation data, and power further attacks. The whole pipeline is automated and runs without a human in the loop. Railway Is the Largest Entry in a Longer List Wiz Research has been tracking https://www.wiz.io/blog/black-october-for-ai-developer-platforms what it calls “Black October”: at least nine AI developer and cloud hosting platforms disclosed credential breaches in October 2026 alone. The list includes Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Warp, CommandCode, and Northflank. Railway, at $740,000 in fraudulent charges, is the most expensive single entry. November has added more: Brev, Trigger.dev, Chainstack, RunPod, Blacksmith, Tensorlake, and NEAR AI have since disclosed incidents. This isn’t a string of unrelated accidents. The Cloud Security Alliance documented a 376% increase https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-offensive-agentic-infrastructur/ in credential theft targeting AI services between Q4 2025 and Q1 2026. This is an industrialized, automated campaign, not opportunistic hacking. The economics explain why. Stolen AI credentials are uniquely valuable: a single API key can generate tens of thousands of dollars in inference within hours before a provider flags it. Stolen cloud credentials used to mean mining VMs with real hardware costs for the attacker. Stolen AI keys mean pure margin. Validated keys are on resale markets within 30 minutes of theft. What Developers Need to Do Today Railway has patched the vulnerabilities, rebuilt affected infrastructure, and says it is working with AI providers to reimburse customers hit with fraudulent charges. But Railway cannot rotate your keys for you. If you have stored AI provider credentials on Railway — or on any of the 17+ platforms named in Black October and November’s follow-on disclosures — treat those keys as compromised regardless of whether you received an individual notification. Rotate them directly with Anthropic, OpenAI, AWS, Google, and any other provider today. Beyond rotation, the deeper fix is structural. Storing secrets as platform environment variables is convenient and common, and it is proving to be the single point of failure across every one of these breaches. Dedicated secrets managers — HashiCorp Vault https://developer.hashicorp.com/vault , AWS Secrets Manager, GCP Secret Manager, Azure Key Vault — exist precisely because concentrated credential stores are a high-value target. If your architecture still relies on platform env vars for AI provider keys, that is the risk to address. Set spending limits and usage alerts on all AI provider accounts. The attackers’ window before revocation is narrow — a spending spike is often the first signal. Enable audit logs. Scope API keys to the minimum they actually need: specific models, specific endpoints, with geographic restrictions where your provider supports them. The Railway post-mortem https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/ is a detailed, honest account of how a sophisticated attacker moved through a hardened platform in 26 hours. Every developer building on hosted infrastructure should read it, then check their secrets inventory.