Railway breach: stolen AI keys drove $740,000 in fraudulent usage, and distillation was the goal

Attackers who broke into the cloud platform Railway in October went looking for one thing above all: keys to AI models. Railway says that stolen customer secrets have so far produced about $740,000 in fraudulent AI usage, according to a BleepingComputer report on its November 10, 2026 incident update. The case matters beyond one hosting company, because it shows that an API key for a frontier model is now a high-value target in its own right, something to be stolen, resold or used to copy a model.

What Railway has disclosed

Railway first disclosed the incident on October 22 and told customers to rotate their secrets. Its preliminary report, titled "Preliminary Report: Oct 21st Security Incident", lays out a timeline in UTC. The attack window began on October 20 at 13:58, when monitoring paged engineers about abnormal latency. By 19:53 that day Railway says it became aware of "a sustained and targeted campaign" against its services.

On October 21, the report says, the attacker could at first pull secrets only in encrypted form. Between 05:27 and 07:25 the attacker obtained CI credentials and decrypted artifacts holding additional API access. Between 07:25 and 09:18 there was an unauthorized query of encrypted environment variables, and a subset was decrypted. Railway notified vendors to revoke potentially exposed keys at around 09:25. By 03:32 on October 22 it confirmed the attacker no longer had access to internal systems, and full API restoration followed that evening.

The November 10 update adds scale and method, per BleepingComputer. The attackers exploited a previously unknown flaw in Railway's build infrastructure to escape filesystem isolation and obtain an internal credential. They used it to reach stored build histories and copy Railway's internal source code. A second flaw, an improperly configured trust relationship, gave them credentials to decrypt customer environment variables.

The numbers, and what they do not say

Railway says the attackers decrypted environment variables for at most 1.85% of workspaces, about 100,000. The company is explicit that this is the maximum potentially affected, not the confirmed number of victims. Linked-account tokens for 1,852 users, including GitHub OAuth tokens and AI agent keys, were exposed and have been reset.

The $740,000 figure is the headline, and it is Railway's estimate of fraudulent AI usage generated with stolen secrets. Railway says it is working with affected providers to reimburse customers and will cover any charges the providers decline to refund. It reports no evidence that attackers downloaded customer Git repositories or accessed customer databases, though its preliminary report said it had not ruled out access to user source code pending a final forensic report.

Why AI keys, specifically

BleepingComputer reports that the attackers specifically searched for AI provider credentials, although some queries also targeted cloud, database and payment-service credentials. Railway's preliminary report says the attacker was seeking AI provider API keys "to perform distillation attacks", and its FAQ says the aim was likely "for distilling model weights."

Distillation is the practice of training a smaller model on the outputs of a larger one. Done with a legitimately purchased key it is usually against the provider's terms, and done with stolen keys it moves the cost to the victim. That reading, that the attackers wanted AI keys for resale or distillation, is Railway's belief, as BleepingComputer reports it. No attacker has claimed it.

The incident is also part of a pattern. BleepingComputer says it is linked to a wave of attacks on AI developer platforms that the security firm Wiz calls "Black October", with other targets including Northflank, OpenCode, Warp and Lightning AI. We have not independently verified the Wiz naming or the other victims.

A discrepancy about AI agents

One point needs care. BleepingComputer describes a roughly 26-hour contest between Railway's engineers and attackers using AI-powered agents, and quotes Railway: "This was not a single breach followed by a single fix." But the preliminary report we read does not describe an AI agent operating as part of the attack. It says the attacker likely had access to "abliterated models and substantial compute resources," which it says enabled "highly sophisticated exploits", without saying how those models were used.

Abliterated models are open-weight models modified to remove their refusal behavior. The phrase suggests the attackers used uncensored models to help build exploits. It does not establish that an autonomous agent ran the intrusion. The distinction matters because claims of AI-run hacking are easy to overstate, and the evidence here supports a narrower statement: Railway believes its adversary had capable models and compute.

What it means for anyone holding AI keys

The practical lesson is dull and urgent. Secrets stored as environment variables on a platform are only as safe as that platform's build system. If you deploy on a hosted service, assume a breach of the host can expose your keys.

• Rotate AI provider keys on any platform that has disclosed an incident, and do it at the provider, not only in the platform's dashboard.
• Set hard spending limits and per-key rate caps at the model provider, so a stolen key cannot run up a six-figure bill overnight.
• Use separate keys per project, so one leak does not hand over everything.
• Alert on usage from unfamiliar regions or at odd hours.

For the race, the broader point is that model access has become something worth stealing at scale. As frontier labs gate their strongest systems more tightly, as in our tracker of restricted-access cyber models, keys to the unrestricted tiers become more valuable still. We would watch for Railway's final forensic report, for whether providers publish how much fraudulent usage they refunded, and for any evidence of a distilled model that traces back to stolen access.