Railway Publishes Its October Security Incident Report: Attackers Broke Out of Build Infrastructure, Environment Variables of Up to About 100,000 Workspaces May Have Been Decrypted, and Stolen AI Keys Ran Up About $740,000 in Unauthorized Charges

Cloud app-hosting platform Railway published the full report on its October security incident on November 10. On October 20 an attacker used a previously unknown vulnerability in its build infrastructure to partially escape filesystem isolation and obtain a build credential; the next day an erroneously defined OIDC binding gave the attacker a cloud credential used to decrypt a subset of customer environment variables. Railway puts the upper bound at 1.85% of workspaces, about 100,000. Unauthorized spend on stolen AI provider keys is estimated at about $740,000, and linked-account tokens for 1,852 users were reset. Railway says the attacker was specifically targeting AI provider credentials and that it will cover charges providers decline to refund.

Two entry points, about 26 hours

Railway's November 10 report reconstructs the attack in UTC. At 06:50 on October 20 the attacker began probing the build infrastructure, and at 07:28 a previously unknown vulnerability allowed a partial escape from filesystem isolation, exposing a build server credential. With it the attacker read stored histories of 353 builds and a snapshot of an internal code repository. Railway halted builds at 17:03 that day and replaced the credential, but at 03:26 on October 21 the attacker obtained a short-lived cloud credential through an erroneously defined OIDC binding, queried encrypted data and decrypted keys for some environments. The attacker was fully evicted at 09:24.

Impact given as an upper bound

According to the report, the customer variables the attacker could decrypt belong to at most 1.85% of workspaces, about 100,000. The logs identify environments rather than individual variables, so this is an upper bound, not a confirmed count of stolen secrets. Linked-account tokens for 1,852 users, covering bring-your-own agent keys and GitHub OAuth tokens, were reset and each user was notified. Unauthorized spend on the stolen keys is estimated at about $740,000. Forensics found no sign that customer repositories were downloaded or customer databases accessed.

After the AI keys

Railway believes the attacker was specifically targeting AI provider credentials and points to Anthropic's post on distillation attacks as a likely motive. The report mentions the pattern Wiz calls "Black October" but states that Railway does not independently attribute the incident. On refunds, AWS Bedrock and Google Gemini have started refunds, OpenAI reviews cases individually, talks with Anthropic are ongoing, and OpenRouter is keeping its no-refund policy; Railway says it will cover whatever providers decline to refund. Remediation includes a dedicated ephemeral VM for each build, a rebuilt CI system and rotation of every relevant key. Teams that keep AI keys in a hosting platform's environment variables should still check provider dashboards for usage since October 20.

via: Railway Blog: Incident Report: October 21st Security Attack, BleepingComputer: Railway breach leads to $740,000 in fraudulent AI charges