Railway estimates breach-related AI charges at $740,000

By Nathan Brooks

Railway estimates that unauthorized charges on AI credentials stolen during an October breach could reach about $740,000. The cloud platform for deploying apps said on Tuesday that an attacker broke into its systems and stole customer secrets, chiefly keys for AI providers.

Railway will cover charges that providers such as OpenRouter decline to refund, placing the unreimbursed portion with the platform rather than customers. At most 1.85% of workspaces, or about 100,000, may have had environment variables decrypted, according to the incident report.

Railway calls 1.85% an upper bound because its logs identify environments rather than individual variables. It found no evidence that attackers accessed customer databases.

Railway wrote: “This was not a single breach followed by a single fix.” The company described the struggle as “a contest of agent speed,” with the attacker using AI agents while engineers hardened systems in parallel.

What did the attacker expose?

Railway confirmed that attackers exposed linked-account tokens for 1,852 users. The tokens included GitHub OAuth tokens and bring-your-own agent keys; Railway reset them and notified each affected user. The $740,000 charge estimate is not a reconciled loss total.

How did the attacker enter?

At 07:28 UTC on Oct. 20, the attacker exploited a previously unknown flaw in Railway’s multi-tenant build system to partly escape filesystem isolation and take a build credential. An internal Temporal cluster accepted that credential as a trusted client, exposing histories of 353 builds and their secrets.

The attacker could also fetch a copy of Railway’s internal monorepo. Early on Oct. 21, a misconfigured OIDC binding produced short-lived cloud credentials.

Those credentials reached a machine holding a long-lived decryption credential, allowing access to the encrypted-variable database. The attacker queried that database for AI provider keys and decrypted keys in two windows before Railway evicted the intruder at 09:24 UTC.

Railway first warned customers to rotate secrets on Oct. 22. Each build now runs on its own short-lived virtual machine with a credential that can push only one image, and every encrypt and decrypt operation is logged. The setup now resembles a locked workbench rather than a shared server: narrow, temporary and traceable.

Who bears the $740,000?

Railway believes the attacker intended to sell the AI credentials for model distillation. Refund treatment now varies by provider:

• AWS Bedrock and Google Gemini apply their fraud policies.
• OpenAI and SpaceXSI review cases individually.
• Anthropic: Railway is covering charges while it talks with the provider.
• OpenRouter: The company is enforcing its no-refund policy.

Railway says it will cover losses that providers will not refund. That policy makes Railway the payer of last resort for unreimbursed provider bills, although the roughly $740,000 charge estimate remains provisional.

Does the incident extend beyond Railway?

BleepingComputer reported that Wiz links the incident to a wider campaign it calls “Black October,” which also hit Northflank, OpenCode, Warp and Lightning AI. Railway said Wiz’s research does not attribute its incident to a particular actor.

Separately, MLQ.ai reported on Nov. 7 that Railway apologized after an engineer’s AI testing agents probed rival host Primcloud. Railway described that episode as separate from the October intrusion.

Going forward, customer pricing should remain insulated while Railway and its providers resolve the roughly $740,000 estimate. Railway’s pledge to absorb unreimbursed charges leaves the cost with the platform rather than shifting it to users.