Security Disclosure Recommendation: Check for Unexpected Grok Usage

This guide is part of Railway's response to the security disclosure published on October 21, 2026.

If you use Grok with Railway, disable any xAI API key that may have been exposed, review the Usage Explorer for requests you didn't make, and redeploy your services with a new key.

If you have an xAI API key that may have been exposed, or your credit balance dropped without a matching change in your traffic, check your Grok usage. xAI's guidance is to disable or delete the key in the Console, create a replacement, and update your applications.

This guide applies the guidelines from xAI's security FAQ, extended to include Railway-specific operations.

Disable the key #

xAI keys belong to a team, so confirm you're viewing the right team before you look for the key. Your Railway services can't reach xAI until you deploy the replacement key in the next section.

1. Sign in to the xAI Console and select the team that owns the key.
2. Click API Keys in the sidebar.
3. Click the vertical ellipsis next to the exposed key and select Disable key to stop it immediately, orDelete key to remove it permanently. Disabling is reversible and keeps the key's usage history attached to it, which helps the review below.
4. Click Create API Key to generate a replacement. Copy it now. The Console doesn't show it again.
5. Optional: after the review below, delete keys programmatically with the Management API , which needs a management key fromSettings thenManagement Keys .

curl https://management-api.x.ai/auth/api-keys/{apiKeyId} \
  -X DELETE \
  -H "Authorization: Bearer $XAI_MANAGEMENT_KEY"

xAI participates in GitHub's secret scanning program. If a key is found in a public repository, xAI disables it and emails you. You still need to deploy a replacement key on Railway and review usage.

Update the key on Railway #

On Railway, your xAI key is a variable, so updating it means editing the variable and redeploying.

1. Open the service that uses the key and click Variables . If the key is ashared variable , edit it once inProject Settings and every service that references it gets the new value when you deploy.
2. Set the variable to the new key, then deploy the staged change .
3. Confirm the new deployment is active and its logs show successful requests to xAI.

Review for misuse #

The Usage Explorer lets team admins filter by API key and by request IP, which helps separate an attacker's traffic from yours.

1. Open Usage in the Console sidebar. SeeUsage Explorer .
2. Set Group by toAPI Key and the granularity to daily. Compare the exposed key's spend against its normal pattern during the exposure window.
3. Add a filter for the exposed key, then group by request IP, model, or cluster. If you see requests to models you don't use, that's likely the misuse. If your services use static outbound IPs , requests from any other IP are too. Without static IPs, your services egress from shared Railway IPs, so an unfamiliar address is a lead rather than proof.
4. Switch Dimension toTokens orBilling items to quantify the unexpected usage.
5. Open Billing and check the credits consumed and any purchases you didn't make.
6. Review the team's members in Settings thenTeam for people you didn't invite.
7. If you need the charges reviewed, keep the usage details and contact xAI through the Console.

If you have any other questions, contact Railway support at support@railway.com.