TL;DR: What does Railway's final breach report mean for me?
On 10 November 2026, Railway published its full report on the October attack. The attacker escaped a shared build machine, found a cloud misconfiguration and decrypted environment variables for at most 1.85% of workspaces, about 100,000. They were hunting for AI API keys, and spend on the stolen keys is estimated at about $740,000. The good news: Railway now says it will cover token losses that AI providers won't refund, after saying on 26 October that it couldn't. If you deploy on Railway, rotate every secret you stored before 21 October, check your AI bills, and file a charge report for anything you didn't spend.
Three weeks ago, Railway told its customers to rotate their secrets and gave few details. Now we know what happened, and it's worse and more interesting than the first notice suggested.
Railway's final incident report describes a 26-hour fight against an attacker who used AI agents to probe the platform faster than one team could patch it. The target wasn't customer data. It was AI provider keys, the credentials that let anyone run up a bill on your Anthropic, OpenAI or Google account. If you build with AI and host on any platform that holds your keys, this is the report to read this week.
What happened, step by step
The report was published on 10 November and last updated the same day at 18:02 UTC. It's signed by Jacob Cooper, Angelo Saraceno, Sarah Bedell and Luca Casonato. Here's the chain, in Railway's own timeline (all times UTC):
- 18 October: the attacker started creating dummy accounts. All of those first probes failed.
- 20 October, 07:28: a previously unknown flaw let them partly escape the isolation of a shared build machine and take a build credential.
- 20 October, 13:50 to 15:30: with that credential they read the stored histories of 353 builds, "sealed variables included", and fetched a copy of Railway's internal code. An unusual call paged Railway's on-call engineer at 13:58.
- 21 October, 03:26: after scanning that code, they found "an erroneously defined OIDC binding configuration" in a cloud environment. It gave them a short-lived cloud credential, and from there a longer-lived one that could read encrypted environment variables from a production database.
- 21 October, 09:24: Railway evicted the attacker. From 09:25 it asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke keys, sending hashes of every key it held.
Railway is blunt about how it felt: "This was not a single breach followed by a single fix." The attacker tried many routes in parallel, and "the escalating situation became a contest of agent speed." Citing Wiz, Railway says the attacker used AI models with their safety limits removed.
What was taken, and what wasn't
The attacker decrypted a subset of customer variables "for at most, 1.85% (~100,000) of workspaces." That's an upper bound. Their database queries targeted AI provider keys, though one query also matched cloud, database and payment service credentials. Railway says forensics didn't show that customer databases were accessed.
The decrypted data also included linked-account tokens, meaning AI agent keys that users brought themselves and GitHub OAuth tokens, for 1,852 users. Railway reset all of them, told each user, and found no logins to Railway accounts with stolen credentials. Unauthorized spend on the stolen keys was "estimated to reach ~$740,000." As The Hacker News points out, the report doesn't say how that figure was calculated or what period it covers.
This wasn't a one-off. Railway itself says OpenCode, Warp, Fireworks AI and others "disclosed similar thefts between October 6th-23rd." Security firm Wiz calls it "Black October" for AI developer platforms and has kept a running list. Our earlier coverage of the first Railway notice and the LiteLLM malware and of the OpenCode breach covers the start of it.
Source: Wiz, "Black October" for AI Developer Platforms, updated 10 November 2026. Wiz says most of these incidents are still being analyzed.
Wiz also found that stolen keys were tested within 30 minutes of the credential theft. According to CSO Online, which cites Wiz, the heavy traffic came four to seven days later. That gap is your window: rotate fast and you beat the thief.
Who pays for the stolen AI spend
This is the part founders care about most. On 26 October, according to The Hacker News, Railway told customers that "Railway is unable to refund customers for spend performed with compromised API keys." The final report changes that. Railway now says it will be "covering all token losses" for providers that won't refund them. Here's the provider-by-provider picture Railway gives:
Source: Railway incident report, 10 November 2026.
One caution from The Hacker News: the charge report form says Railway "is not responsible for usage of these keys", and neither the form nor the report sets a cap or a deadline for claims. File early, keep your invoices, and don't assume a refund until it lands. If you're still working out what AI actually costs your startup, our guide to AI token costs helps you spot a bill that doesn't look like yours.
What Railway changed
The fixes are worth reading even if you never used Railway, because they're a good checklist for any platform that holds your secrets:
- Every build now runs in its own short-lived virtual machine, and its credential can only push one container image. The shared systems the attacker used are gone.
- The CI pipeline needs 2FA and biometric approval in critical areas, with full logging and alerting.
- Credentials are short-lived, narrowly scoped and issued just in time. Every service account was reviewed.
- Every encrypt and decrypt operation is now logged centrally, and only the secrets service can reach the keys that decrypt your variables.
- Railway rebuilt its internal certificates from a new root and rotated every relevant key. It also sent a complaint to the FBI's IC3 and hired a forensics firm, whose work is still going on.
Frank Dickson of Dickson Research told CSO Online that short-lived credentials and logging every decryption is the right fix, and that every platform holding customer secrets should copy it. His advice to customers was sharper: "Railway customers should treat every secret stored on the platform as stolen until they have rotated it."
What this means for you
- Rotate, even if you got no email. Railway's preliminary report told customers to revoke and reapply every sensitive variable stored before 21 October. Do it at the provider that issued the key, so the old key really dies. Changing it only in Railway's dashboard isn't enough.
- Read your AI bills from 20 October onward. Look for usage at odd hours, models you don't use, or spikes. Report anything you didn't spend through Railway's charge form, and keep the provider's case numbers.
- Put a spend limit on every AI key. A stolen key with no cap is an open credit card. Many providers let you set spending limits or alerts per project or key. Our guide on building security into a startup shows where to start.
- Use one key per app and per environment. When something leaks, you rotate one key, not your whole stack. Fewer, narrower keys also make a bad bill easier to trace. The same lesson came from Claude Code saving secrets in settings files earlier this month.
- Check whether personal data was reachable. If a leaked database or payment credential could open customer records, you may need to notify your data protection authority within 72 hours of becoming aware of it, unless it's unlikely to put people at risk, under Article 33 of the GDPR (Adopted). Our GDPR checklist for early-stage startups walks you through it.
- Ask your host the hard questions. Who can decrypt your variables? Is every decryption logged? Do builds share machines? If a vendor can't answer, keep the most valuable keys somewhere else.
My take: credit to Railway for a detailed, honest report and for paying for losses it first said it couldn't refund. Most platforms never publish this much. But look at the pattern. A month ago, an AI key was a config value. Now it's money, and attackers with their own AI agents hunt for it across a dozen platforms at once. As David Shipley of Beauceron Security put it, "AI credentials are becoming the new credit card numbers." Bootstrapped founders can't absorb a surprise five-figure AI bill. Treat your keys like your bank card: caps, alerts, one per purpose, and rotation the day anything looks off. For the rest of this month's incidents, see our cybersecurity news for November 2026 and AI news for November 2026.
Are you getting customers from AI search yet?
More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.
👉 Rank on ChatGPT
FAQ: Railway's October breach report
Was my Railway project affected?
Railway says the attacker decrypted variables for at most 1.85% of workspaces, about 100,000, and that this is an upper bound. Because it can't name every exposed variable, it advises all customers to revoke and reapply sensitive variables stored before 21 October.
What was the attacker after?
AI provider keys. Railway says the attacker's database queries targeted AI key variable names, and estimates unauthorized spend on the stolen keys at about $740,000.
Will I get my money back for fraudulent AI charges?
Railway says AWS and Google have started fraud refunds, OpenAI and SpaceXSI review claims case by case, and Railway covers Anthropic and OpenRouter costs, plus token losses from any provider that won't refund. Report the charges through Railway's form and keep your invoices.
Were customer databases accessed?
Railway says forensics did not show that customer databases were accessed. One attacker query did match cloud, database and payment credentials, so rotate those as well.
Is Railway safe to use now?
Railway says it has moved every build to its own short-lived virtual machine, logs every decryption, uses short-lived scoped credentials and rotated every relevant key. Whether that's enough is your call, but no platform is safe for a key without a spend limit.
Which other platforms were hit?
Railway names OpenCode, Warp and Fireworks AI. Wiz's "Black October" tracker also lists Andromeda, Zeabur, Lightning AI, CommandCode, Northflank and, by 10 November, seven more, including Trigger.dev and NEAR AI.
About the Author
Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
