AI agents operated by cloud infrastructure and application hosting platform, Railway, have attempted to access a rival platform’s infrastructure, prompting the cloud provider’s leadership to acknowledge the incident on social media.
Railway senior product engineer Jake Runzer acknowledged running agents to perform signups and agentic testing on similar platforms after Primcloud founder Josh Manders publicly questioned why Railway employees were attempting to breach his infrastructure.
Runzer said he had halted the testing harness after it began reaching too far. Railway co-founder and CEO Jake Cooper apologized, saying the models were “getting a bit too good at this point,” and pledged to prohibit non-manual external testing.
According to Manders, the agents attempted to receive credentials from an application container, request platform secrets, access cloud-provider metadata, discover internal databases and caches, and scan all 65,536 addresses on Primcloud’s internal network twice.
The activity reportedly involved 24 scripted commands over 15 minutes.
“An agent can act without a person directing every step,” said Diana Kelley, chief information security officer at Noma Security. “It doesn’t remove the responsibility of the people and organizations that deploy it.”
Primcloud said its defenses blocked every attempt and that “nothing” was accessed. The incident follows Railway’s own security disclosure involving encrypted customer environment variables.
Cooper said the employee had developed the testing tool independently, using personal accounts, a personal credit card, and his own time. He added that Runzer ran it against a single external provider and halted it proactively within 15 minutes, adding that Railway had addressed the incident internally.
“I can confirm they ran this tool once and only once,” Cooper said in an X post. “Railway does not condone these actions. We expect all our employees to uphold our standards of conduct, whether acting on behalf of Railway or in a personal capacity.”
Although that timeline checks out with Manders’ own account, some details remain murky. After publicly calling out Runzer on X, Manders posted a follow-up, saying he had observed another attempt to access the account after his initial warning.
“I see you tried to access the account after this tweet too, Jake,” he had written more than 30 minutes after his first post.
Primcloud does not have a bug bounty program, according to its Acceptable Use Policy (AUP). It forbids unauthorized probing, scanning, or vulnerability testing without prior written consent.
Experts condemn Railway’s “rogue AI” explanation for the incident.
Amir Boldo, co-founder and chief product and technology officer of Above Security, cautioned against describing agents as attackers, as they can execute attacker-like sequences without any malicious intent.
Execution traces can establish what an agent did, but they cannot independently prove intent, he said, adding that investigators need evidence spanning instructions, identities, permissions, inputs and tool calls. “You can’t put an agent on trial. You can hold each party accountable for its part,” Boldo said.
Ronald Lewis, head of cybersecurity governance at Black Duck, argued that users may not fully appreciate that delegating work to an agent also delegates the authority associated with their identity.
“We now have to ask what happens when trusted identity is delegated to a non-deterministic system capable of independently deciding how to use it,” Lewis said. Cooper confirmed in his X post that Railway had addressed the incident internally and was reinforcing its expectations for employee conduct, including when employees act in a personal capacity.