A Railway engineer admitted testing AI agents on Primcloud, whose founder says they sought customer secrets and scanned its network.
An engineer at cloud platform Railway has acknowledged running AI agents against competing cloud platform Primcloud after its founder reported attempts to obtain customer secrets and scan internal systems. Primcloud says its controls blocked the attempts and no customer data was accessed.
Josh Manders, Primcloud’s founder, publicly challenged Railway on November 3, identifying senior product engineer Jake Runzer as the person behind the activity. Runzer accepted responsibility for running the agents, describing their purpose as signups and automated testing on similar platforms.
Railway co-founder and CEO Jake Cooper initially apologised. In a later statement, he said the employee built and operated the tool personally outside work hours and that Railway took internal action.
His explanation adds an important distinction to the dispute, which concerns an employee’s acknowledged activity, not evidence of a company-directed operation against a competitor.
Primcloud Describes Attempts to Reach Other Customers’ Secrets
According to Manders’ account, the activity went considerably further than trying the platform’s signup process. He said credentials available inside the account’s application container were used to request platform secrets, including those belonging to other customers.
The agents also attempted to reach the cloud provider’s metadata endpoint, checked what the container credentials could access and searched for databases and caches by guessing internal names, Manders said. Cloud metadata services can expose temporary credentials when accessible without adequate restrictions.
Manders described roughly 24 commands over 15 minutes, including two scans covering 65,536 internal network addresses. That is his reported address count, not a count of confirmed live hosts or exposed services. He said no application was run and the attempts to reach protected resources were blocked.
These technical details remain Primcloud’s account of the activity. Runzer acknowledged operating the agents, but that acknowledgement does not independently verify every command, target or outcome Manders described.
Railway Says the Tool Was a Personal Project
In his reply to Manders, Runzer said he had been running agents for signups and testing on similar platforms. He denied malicious intent and said he had stopped the system after recognising that it was reaching too far.
Cooper’s later statement described a personal tool intended to identify and report bugs through bounty programmes. He said the employee used personal accounts, a personal credit card and a subscription to a hosted service running DeepSeek.
According to Cooper, the tool ran once against one external provider and was stopped within 15 minutes. He said Railway did not condone the conduct and had addressed it with the employee, without specifying what action had been taken. He also distinguished the activity from Railway’s authorised internal security testing.
The description of the tool as a bug-bounty project does not establish that Primcloud authorised the testing. Nor do the public statements establish why the agents selected each action or how closely a person supervised their execution.
Responsibility Remains With the Operator
For the company receiving the requests, the immediate concern is what the software does inside its environment. Ram Varadarajan, CEO of Acalvio, said in comments shared with Hackread.com that distinguishing an agent’s intentions is an unreliable basis for protection.
“Whether you call it a rogue agent or agentic testing, the defender sees the same behavior: something inside the environment is harvesting credentials and mapping the network. Unfortunately, you can’t reliably classify AI intent, especially with autonomous agents.”
Varadarajan said decoy credentials and fake internal assets can help identify activity that legitimate workflows should not trigger, regardless of whether a person or an agent initiates it.
Diana Kelley, Chief Information Security Officer at Noma Security, said organisations remain responsible for addressing actions taken by agents operating under their authority. That includes investigating incidents, notifying affected organisations and putting controls in place to prevent a recurrence.
“An agent can act without a person directing every step. It doesn’t remove the responsibility of the people and organizations that deploy it.”
Railway Disclosed Its Own Breach in October
The dispute follows a separate security incident at Railway. In its October 21 disclosure, the company said an unauthorised party may have accessed encrypted customer environment variables and obtained some decrypted contents. Those variables can contain API keys, database passwords and other credentials.
Railway’s preliminary report, published the following day, described unauthorised access to internal systems and confirmed that some encrypted environment variables had been decrypted. It advised customers to rotate sensitive credentials stored before October 21.
The report put the upper estimate of workspaces with some environment variables exposed at 1.85%, approximately 100,000 workspaces. Railway said precautionary requests to revoke credentials affected a larger population, so receiving a revocation notice did not itself establish that a customer’s secrets had been compromised.
