Railway Details How AI Agents and Build System Flaws Led to $740,000 API Key Theft

Cloud development platform Railway has detailed a significant security incident where attackers leveraged a combination of build system flaws, AI agents, and misconfigurations to steal customer API keys and incur substantial unauthorized charges. In a report released November 10, Railway outlined how the breach unfolded, involving multiple stages of exploitation and persistence attempts.

The initial exploit, which occurred on October 20, exploited a previously unknown flaw allowing the attacker to partially escape the build system's isolation. This enabled them to read files on the host machine, including a credential used by build servers to access internal services. This credential possessed more trust than intended, allowing the attacker to access sensitive build histories and customer secrets stored within the system. Furthermore, access to cached repository snapshots exposed Railway's internal codebase, providing AI agents with a detailed map to identify and test potential weaknesses.

Railway's engineers detected unusual registry API calls on October 20 and subsequently replaced the compromised credential. However, the attacker, armed with the leaked codebase, found an alternative entry point. A critical misconfiguration in the OpenID Connect (OIDC) trust setup on October 21 exposed a short-lived cloud credential. This credential was then used to retrieve internal access keys and an SSH private key, granting the attacker access to a machine responsible for coordinating customer workloads.

From this compromised machine, the attacker gained network access to the production database and obtained a credential capable of authorizing secret decryption. They then used Railway's key management service to decrypt sensitive customer environment variables. Railway emphasized that this was a case of credential abuse, not a breach of encryption itself. The stolen data included linked-account tokens for over 1,800 users, which have since been reset.

The attackers specifically targeted database queries for AI provider key names, suggesting a motive to exploit these credentials for AI services. Railway believes the stolen keys were likely used in "LLMjacking" attacks, where threat actors consume paid AI services at the victim's expense, potentially for model distillation or resale of AI access. The estimated financial impact of these unauthorized charges reached approximately $740,000.

While the incident report details the technical aspects of the breach, Railway stated that it has not established whether the intruder operated the AI services where the stolen keys were ultimately used. The company also noted that while Wiz's "Black October" investigation identified a broader pattern of credential theft, it did not independently attribute the Railway breach.

In response to the incident, Railway revoked all compromised credentials, rebuilt its internal systems, and restored affected builds by October 22. The company is working with AI service providers to secure refunds for affected customers and has pledged to cover breach-related charges where providers decline reimbursement. Customers have been advised to rotate any potentially exposed secrets, review their provider usage, and report any fraudulent charges.

This incident highlights the growing threat of "LLMjacking" and the sophisticated methods attackers are employing, including the use of AI agents and the exploitation of cloud infrastructure misconfigurations, to steal valuable API keys and credentials.