Railway Security Incident Exposes Customer Environment Variables and AI Keys
Do Son 
TL;DR
A recent Railway security incident allowed an attacker to decrypt customer environment variables across up to 100,000 workspaces. Specifically, the threat actor chained a build isolation escape with an OIDC misconfiguration to execute a targeted AI keys breach. Ultimately, the stolen credentials racked up roughly $740,000 in unauthorized token spend before engineers evicted the intruder.
What was exposed
Between October 20 and October 21, 2026, an unauthorized actor accessed and decrypted a subset of customer environment variables. Forensic logs show the attacker primarily targeted AI provider credentials alongside select cloud, database, and payment keys. In addition, the intruder read the stored histories and sealed variables of 353 builds on October 20.
Furthermore, the decrypted data included linked-account credentials such as Bring Your Own Key (BYOK) agent keys and GitHub OAuth tokens for 1,852 users. In its official post-mortem, the company noted that “Based on our forensic investigation, we believe the attacker was specifically targeting AI provider credentials, that they could sell to distributed transfer stations for use in distillation.” However, forensic investigators found no evidence that the intruder accessed customer databases. Moreover, they found no evidence that the intruder downloaded customer source code repositories.
Confirmed vs. unverified impact
Railway confirmed that at most 1.85% of workspaces, or roughly 100,000 environments, could have had their variables decrypted. Because platform logs track affected environments rather than individual variables, that 100,000 figure represents a confirmed upper bound. Meanwhile, the company estimates that unauthorized spending on the stolen keys reached approximately $740,000 across external AI platforms.
How it happened
The Railway security incident unfolded over two distinct phases after initial dummy account probing began on October 18. First, at 07:28 UTC on October 20, the attacker exploited an unknown vulnerability in the multi-tenant build infrastructure to partially escape filesystem isolation. Consequently, the intruder read host virtual machine files. The intruder also stole an internal build credential.
Although engineers intended that credential only for image registry pushes, an internal self-hosted Temporal cluster accepted it as a trusted client. Through a Temporal API, the attacker retrieved build histories. The attacker also downloaded a cached snapshot of Railway’s internal monorepo. When describing the rapid escalation, the company stated that “The escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz.”
Secondary entry point and decryption
Even after engineers patched the builder and revoked the build credential at 17:28 UTC on October 20, the attacker scanned the stolen monorepo source code for new flaws. At 03:26 UTC on October 21, the intruder exploited an erroneously defined OIDC binding configuration in a cloud environment to obtain short-lived cloud credentials. Next, the actor pulled an internal SSH private key and connected to a fleet orchestration machine inside an internal VPC.
That orchestration server held a longer-lived credential on disk used to decrypt envelope-encrypted customer variables. Between 04:07 UTC and 07:14 UTC on October 21, the attacker queried the production database using regular expressions. Furthermore, the attacker authenticated to the key management service to decrypt matching keys.
Who is affected
This AI keys breach impacts Railway workspace owners who stored third-party API credentials in their environment variables, especially users with large variable counts. This incident also mirrors a broader industry wave documented in Wiz’s “Black October” research. That research tracked stolen AI credentials flowing to resale operations. Similarly, platforms including OpenCode, Warp, and Fireworks AI disclosed comparable credential thefts between October 6 and October 23, 2026.
What affected people should do
Customers who received high-risk notification emails must rotate all environment variables, API keys, and service tokens stored on the platform. Because Railway invalidated all user sessions, CLI tokens, and project tokens on October 21, users also need to re-authenticate their workflows. Additionally, customers who experienced fraudulent AI billing should submit a claim form via the Railway support station.
AWS Bedrock and Google Gemini are already processing fraud refunds directly through their account teams. For OpenAI and SpaceXSI charges, affected users should open a vendor support ticket and share the Case ID with Railway. Meanwhile, Railway is covering all breached key costs out of pocket for Anthropic and OpenRouter users.
Company response
Railway engineers revoked all static and active cloud credentials at 07:14 UTC on October 21 and halted customer builds twice during containment. Starting at 09:25 UTC, the team sent key hashes to GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, and Stripe for emergency revocation. Furthermore, the company accelerated the rollout of a new build architecture that isolates every build inside a dedicated ephemeral virtual machine.
Engineers also rebuilt internal CI/CD pipelines from scratch, enforced biometric and two-factor authentication controls, and restricted key decryption solely to the secrets service. Finally, the company filed a formal complaint with the FBI’s IC3, hired an external forensics firm, and joined the U.S. Treasury’s Project Glasswing.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
