Railway: $740,000 in AI charges, 100,000 workspaces

Railway’s November 10 incident report puts a price on an October intrusion into the cloud hosting platform: about $740,000 in unauthorized spend on customer AI keys. Engineers first saw the intruder at 13:58 UTC on October 20. Railway says the intruder combined several weaknesses inside the platform, decrypted environment variables for at most 1.85 percent of workspaces, about 100,000, and was then removed. The company says that share is an upper bound. Its logs mark environments, so they show where a decryption was possible, and they do not list each variable that left.

The keys were the point. Railway says the intruder’s queries favored AI provider credentials, and that the haul looks destined for resale and for model distillation, the practice of using someone else’s paid model access to train or copy a model. A further query also matched names used for cloud, database, and payment secrets. Railway says it has found no sign that customer databases were opened, no sign that customer repositories or snapshots were downloaded, and no Railway logins that used credentials taken in the incident.

What the logs can and cannot count

On October 20 the intruder also read the stored histories of 353 builds, sealed variables included. Those histories are a second pile, separate from the workspace upper bound. A team whose build ran in that window should assume the secrets handed to that build were in the history the intruder read.

Linked-account tokens for 1,852 users were in the decrypted set: bring-your-own-key agent tokens and GitHub OAuth tokens. Railway says it reset every one of those tokens and wrote to each of those users. Starting at 09:25 UTC on October 21, before it could say which keys were actually exposed, it sent GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, and Stripe hashes of every key it held, so those companies could revoke first. Some vendors revoked more keys than the forensic subset. Railway says the intruder had no path to customer data after 09:25 UTC on October 21. It invalidated every user session and token at 20:19 UTC that day. Builds, paused twice during the response, were back for all plans by 22:49 UTC on October 22. Running deployments kept serving through the build pause. A service whose key had already been revoked still sat on the old value until a new deploy was possible.

Railway has filed a complaint with the FBI’s Internet Crime Complaint Center and has a specialist forensics firm still working. BleepingComputer ties the case to the October run of attacks on AI developer platforms that Wiz calls Black October. The shared prize in that run is a model key sitting next to a workload.

Who pays the $740,000

Railway is asking providers to refund the unauthorized token spend, and it says it will cover charges a provider refuses. The policies it published differ by vendor. AWS Bedrock and Google Gemini are working fraud refunds through their account teams. OpenAI wants the customer to open a support request and pass the case ID to Railway, which has a shared review channel. SpaceXSI wants the claim sent through Railway support. Anthropic’s path was still being negotiated when the report was published, and Railway says it will cover those breached-key costs in the meantime. OpenRouter is enforcing a no-refund term, and Railway says it will cover the OpenRouter charges from this incident itself.

Customers who were billed for calls they did not make should file that spend with Railway at station.railway.com. High-risk workspaces were emailed from the forensics. Silence is a weak comfort: the 100,000 figure is a ceiling on environments, and the early revocation lists were wider than that ceiling.

What to do with a Railway workspace

Rotate every secret that lived in a Railway environment variable or a build in the second half of October. Do it at the provider: model keys, cloud tokens, database passwords, payment secrets, and webhook credentials. A new value saved in Railway, while the old value still works at OpenAI, Anthropic, Bedrock, Gemini, or OpenRouter, has not been rotated. Then check the provider bill from October 21 forward for models, regions, and volume the team did not schedule.

On GitHub, open the authorized OAuth applications and confirm the Railway grant matches a token issued after the reset. Railway says the 1,852 linked tokens were reset. The check is still local, because a copied OAuth token is the user’s to notice.

Put a same-day spend cap on every model key that sits in a hosting platform. Railway’s own number, roughly $740,000, is what an uncapped key costs once it is sold on. The platform can rotate its own credentials, as Railway says it did, including a new internal certificate authority. It cannot close the invoice at the model provider.

This briefing relies on public reporting by BleepingComputer and on Railway’s incident report.