Railway says attackers exploited its application-hosting infrastructure in October to decrypt customer environment variables and steal artificial-intelligence provider credentials, generating an estimated $740,000 in unauthorized usage. The company said it is working with affected providers on refunds and will cover token-related losses that providers decline to reimburse.
According to Railway’s November 10 incident report, the intrusion began with a previously unknown vulnerability in the platform’s multi-tenant build infrastructure. At 07:28 UTC on October 20, the attacker partially escaped filesystem isolation on a build machine and obtained a credential intended for limited registry operations. The attacker then used Railway’s internal Temporal build system and later an incorrectly configured cloud OIDC binding to move into systems holding infrastructure credentials.
Between 04:07 and 05:21 UTC on October 21, the attacker queried Railway’s encrypted variable database, prioritizing rows whose names matched AI provider credentials. Railway said its logs show that some of those variables were decrypted before the company disabled the relevant credentials at 07:14 UTC. The company estimates that no more than 1.85% of workspaces—about 100,000—could have had variables decrypted, although it said that figure is an upper bound rather than a count of confirmed exposures.
The incident also exposed linked-account tokens, including GitHub OAuth tokens and bring-your-own-key agent credentials, for 1,852 users. Railway said it reset those tokens and found no evidence that stolen credentials were used to log in to Railway accounts. It also asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke potentially affected keys. Railway’s forensic analysis indicates that AI credentials were the primary target and that subsequent use included coding agents and training pipelines, but the company has not attributed the operation to a named threat actor or established whether the original attacker ran the services that resold or relayed the stolen access.
Railway said AWS Bedrock and Google Gemini’s existing fraud policies have led to refund activity, while OpenAI and SpaceXSI are reviewing claims case by case. The company said it will cover losses tied to Anthropic and OpenRouter credentials where those providers do not reimburse customers. It has also rebuilt its CI systems, replaced the shared build architecture with dedicated ephemeral virtual machines, narrowed service-account permissions and centralized auditing of secret decryption. Railway’s report does not assign a CVE or CVSS score and does not publish a proof of concept. Customers should rotate every secret stored in Railway, replace AI and cloud credentials, review provider usage logs and report unexpected charges through Railway support.
