Railway Pays $740,000 After Massive AI Key Theft

A group of attackers exploited vulnerabilities at Railway to steal AI credentials and generate $740,000 in fraudulent computing charges. This incident, which unfolded over nearly 26 hours, illustrates the rise of "LLMjacking" and comes with immediate operational recommendations to limit the damage.

Limit the Impact Now on Accounts and Keys

Railway recommends removing public network access to databases, renewing all sensitive variables and keys, monitoring GitHub audit logs and application access, as well as reviewing registries such as Dockerhub. Frank Dickson advises clients to consider every stored secret as compromised until it is renewed. According to Wiz, stolen keys are tested within 30 minutes of theft and then subjected to massive traffic between four and seven days later, necessitating swift action. Dickson recommends starting with AI provider keys, followed by renewing cloud, database, and payment credentials. He also suggests checking invoices and usage logs from AI providers and reporting any unauthorized charges to Railway, as well as alerting on any calls from unknown addresses. To limit exposure, he advocates for spending caps, usage alerts, and fine-grained restrictions on each key; Wiz reports that a heavily restricted key helped limit most malicious traffic in one examined case. Beyond Railway, Dickson encourages asking platforms how secrets are stored and who can decrypt them, and to issue fewer keys. He emphasizes that a stolen AI key incurs real expenses and that the majority of keys now reside in machines, hence his call to protect machine identities like cash. Railway also advised revoking and reapplying sensitive variables stored before October 21.

Fraud Billed at $740,000 and Customer Data Exposed

The attacks generated approximately $740,000 in fraudulent AI usage fees. Railway indicates that around 100,000 customer variables were obtained and decrypted, representing at most 1.85% of workspaces. Customers reported responses to coding questions and training data tasks they had not initiated. More than 1,850 users had exposed linked account tokens; Railway claims to have reset GitHub and OAuth tokens and quickly collaborated with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke potentially compromised keys. The company is working on reimbursing customers, including when some providers refuse to refund. Railway also specifies that attackers potentially accessed up to 100,000 workspace credentials.

Confirmed Timeline and Structured Communication

Railway reported the incident on October 22 and released a follow-up report during the same week as the announcement. According to the company, an investigation is currently underway, and it is impossible to communicate all information or specify the full extent of the exploits. It confirms an intrusion that lasted nearly 26 hours, the complete eviction of the attackers on October 21, and notes that its engineering team worked continuously in shifts.

Intrusion Vectors and Infrastructure Escalation

The attack began on October 20 by exploiting an unknown vulnerability in the build infrastructure. The attackers bypassed filesystem isolation protections, obtained an internal identifier, and accessed build histories. They retrieved Railway's internal source code and analyzed it to find other avenues of compromise. A misconfigured trust relationship was then exploited, opening deeper access to the infrastructure and identifiers that could decrypt customer environment variables. Railway describes a sequence of exploits and lateral movements conducted in parallel, to which defenders responded with simultaneous hardening, emphasizing the absence of a "one breach, one fix" pattern.

The Motive: Key Resale and Model Distillation

According to David Shipley, harvesting AI credentials on a large scale is inexpensive, and targeting a single provider is more profitable than attacking companies one by one. These accesses are resold via AI routers that offer otherwise unaffordable or inaccessible models. Distillation, which transfers knowledge from a large model to a smaller one, motivates this interest. Frank Dickson highlights that large-scale training on another model's responses requires millions of queries; a single account would be detectable, while stolen keys distribute these queries across thousands of legitimate accounts. He reminds that cutting-edge AI is expensive, the key owner pays the bill, and the thief benefits from the computation. He compares this phenomenon to a 2026 version of cryptomining with a similar modus operandi. Shipley believes that LLMjacking is poised to surpass cryptojacking.

Internal Hardening and New Identity Practices

Railway states that it has shut down potentially compromised internal tools, reset all keys, and then performed a second reset after the confirmed eviction of the intruders. The company has transitioned to a new generation of infrastructure, rebuilt operational tools, and deployed a mechanism to revoke application permissions en masse in case of suspicious activity. It is adopting short-lived credentials while logging each decryption. Frank Dickson considers this approach appropriate and recommendable for any platform that retains customer secrets. He commends Railway's transparency, acknowledging a misconfiguration of trust, admitting it cannot guarantee the identification of all accounts created by the attacker, and promising to expedite information to customers.