Key points
- Attackers who breached Railway last month racked up an estimated US$740,000 in unauthorised usage on stolen AI provider keys.
- The intruder decrypted stored environment variables for up to 1.85 per cent of workspaces, around 100,000, plus took linked-account tokens for 1852 users.
- Railway said it would cover losses that providers such as OpenRouter do not refund, as AWS and Google process claims.
Attackers who broke into application hosting platform Railway last month ran up an estimated US$740,000 ($1.07 million) in unauthorised usage on artificial intelligence provider keys stolen from its customers, the company said in an incident post-mortem.
Railway’s incident report said the intruder obtained and decrypted stored environment variables for at most 1.85 per5cent of workspaces, or about 100,000 of them.
The haul also included linked-account tokens, among them GitHub OAuth tokens, for 1852 users.
Database logs showed the attacker ran queries that picked out variables whose names matched AI provider keys, and favoured customers with large numbers of stored variables, Railway said.
Who will pay for the misused keys depends on the provider.
Amazon Web Services and Google have begun refunds under their fraud policies, while OpenAI and SpaceXSI are reviewing claims case by case, Railway said.
Meanwhile, OpenRouter is enforcing the no-refund policy in its terms of service, and Anthropic was still in discussions when the report was published.
Railway said it would cover losses that providers do not.
The intrusion began on October 20, when the attacker exploited a previously unknown flaw in Railway’s build infrastructure to read files on a host virtual machine and take a build credential.
That credential was meant only for tasks such as pushing container images, but an internal workflow system accepted it as a trusted client, exposing the stored histories of 353 builds and a copy of Railway’s source code repository.
With the code in hand, the attacker found a wrongly configured identity binding in Railway’s deployment pipeline, and from there reached a machine holding a credential that could decrypt customer variables.
Railway said it evicted the intruder on October 21.
The company described the response as a “contest of agent speed”, saying evidence which it did not publish indicated the attacker used abliterated AI models, meaning ones with their safety restrictions removed.
Railway theorises that the keys were on-sold for distillation, the practice of querying a commercial model at scale to train a copy, but said it had not established whether the attacker ran the resale services involved.
Costly attacks to steal AI resources
Earlier this week, Nvidia-backed AI inference provider Fireworks AI linked a breach of its systems to a criminal group engaged in LLMJacking.
LLMJacking is the theft of access to large language models, usually through stolen cloud credentials or API keys, with the access resold and the victim left to pay for the usage.
Among the Fireworks customers affected by the breach was Notion, a workspace app combining notes, documents, wikis, databases and project tracking, now with AI features layered on top.
Google-owned security vendor Wiz said late last month that at least nine AI developer platforms, Fireworks among them, had disclosed security incidents in October.
The list has since grown to 15.
Wiz said it traced two stolen enterprise keys to one of those breaches, and watched attackers use them to make about 800,000 and 1.7 million calls to Amazon’s Bedrock AI service, likely running up more than US$100,000 in usage at list prices.
Separately, Google’s Threat Intelligence Group (GTIG) and Mandiant reported fraudulent charges at some victims exceeding US$100,000 in a single day and reaching US$1 million in total.
