Railway recently disclosed a significant security breach where attackers leveraged AI agents, a flaw in the build system, and cloud access errors to steal API keys, resulting in unauthorized charges estimated at $740,000. The breach, which began on October 20, involved a previously unknown vulnerability that allowed the attacker to escape the build system's isolation and access sensitive files. These files contained credentials that enabled further penetration into Railway's internal systems, including cached repository snapshots and internal codebases.
The attackers used models with safety constraints removed, employing an agent framework similar to ARTEX. This allowed them to explore multiple attack vectors simultaneously. Unusual API activity was detected, prompting Railway to replace compromised credentials. However, the attacker found alternative routes using the exposed codebase.
On October 21, an incorrect OpenID Connect configuration further exposed a cloud credential, which was exploited to access the production database and retrieve encrypted environment variables. These were then decrypted using Railway's key management service. While there was no evidence of broken encryption, the attackers utilized the credentials to conduct LLMjacking attacks, consuming AI services fraudulently.
Railway has reset linked-account tokens for affected users and found no evidence of compromised customer database access. The company is collaborating with service providers to secure refunds and mitigate financial losses for affected customers. All compromised credentials have been revoked, and internal systems have been rebuilt to prevent future exploits.
