Railway has disclosed new details about a major security breach in which attackers leveraged AI agents, exploited flaws in its build system, and misconfigured cloud settings to steal customer secrets and rack up roughly $740,000 in unauthorized charges. The company’s post-mortem outlines multiple points of failure as engineers raced to shut down the breach.
How Attackers Exploited Build Systems and AI Agents
The incident began on October 20 at approximately 07:28 UTC, when an unrecognized vulnerability allowed an attacker to partially break out of the build system’s file isolation. This escape enabled access to host files containing credentials used by build servers to interact with internal services and push completed images. Compounding the issue, those credentials carried more trust than intended, enabling the intruder to operate via Railway’s Temporal task system to read histories from 353 builds, access stored secrets, and extract snapshots of internal repositories. Armed with this internal codebase and using AI agents (with safety limits disabled in an agent framework similar to ARTEX), the attacker quickly looked for weak spots in the system—some discovered after initial entry points were blocked.
Cloud Misconfiguration and Secret Exposure
In the early hours of October 21 (around 03:26 UTC), an OpenID Connect (OIDC) trust misconfiguration exposed a temporary cloud credential. That credential allowed the attacker to retrieve internal secrets and an SSH private key. From a machine that coordinates customer workloads—and which had network access to the production database and credentials for secret decryption—the attacker retrieved encrypted variables and used Railway’s key management service to decrypt certain values. While encryption itself wasn’t compromised, the misuse of credentials enabled this unauthorized decryption. The attacker’s queries seemed to target secrets tied to AI provider API keys.
Stolen Data, Unpermitted Usage, and Response Steps
Among data accessed were tokens linked to about 1,852 user accounts; Railway reset these tokens as part of incident response. The company found no evidence that someone used stolen credentials to log into customer accounts or gain access to customer databases. Yet attackers leveraged these stolen credentials in what’s known as “LLMjacking”—consuming paid AI services at the victims’ expense—leading to nearly $740,000 in unauthorized service usage.
Railway rapidly revoked compromised credentials, rebuilt internal systems, and reset builds for all plans by October 22. Users are urged to rotate any secrets that might have been exposed, check their usage across providers, and report fraudulent charges to their providers.
Corporate Fallout and Customer Protection
Railway says it’s working with service providers to secure refunds and will assume financial responsibility for breach-related costs that providers refuse to cover, rather than leaving users to absorb the losses. The company has also launched a formal investigation and is reviewing internal policies to prevent similar incidents.
This attack highlights a growing class of cloud threats: increasingly sophisticated misuse of AI frameworks combined with human error in trust configuration. For organizations using CI/CD systems, cloud credentials, or AI models tied to secret management, this is a warning sign. Expect more scrutiny—and possibly regulation—on how platforms handle trust and credential boundaries going forward.
