Follow us on Google News
Cloud hosting provider Railway has disclosed a major cybersecurity breach in which hackers stole authentication credentials and generated approximately $740,000 in unauthorised AI usage charges. The attack potentially exposed sensitive credentials associated with nearly 100,000 customer workspaces and involved AI-powered agents used to exploit vulnerabilities in the company’s infrastructure.
How Did Hackers Breach Railway?
The attack began on October 20, when cybercriminals exploited a previously unknown vulnerability in Railway’s build infrastructure.
The security flaw allowed attackers to escape filesystem isolation and obtain an internal credential. Using this access, they retrieved stored build histories and copied Railway’s internal source code. The stolen code was subsequently examined to identify additional weaknesses in the platform.
Investigators found that the attackers exploited a second vulnerability involving an improperly configured trust relationship, allowing them to obtain credentials used to decrypt customer environment variables.
How Many Customers Were Affected?
Railway confirmed that the breach potentially affected up to 1.85% of its customer workspaces, representing approximately 100,000 workspaces.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
The company clarified that this figure represents the maximum number potentially exposed, rather than the confirmed number of workspaces whose secrets were stolen.
The incident also exposed linked-account authentication tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys. Railway subsequently reset the affected tokens and notified users whose credentials were involved.
How Did Hackers Use AI?
The attackers reportedly deployed AI-powered agents to identify and exploit security weaknesses throughout Railway’s infrastructure. The intrusion developed into an approximately 26-hour confrontation between the attackers and Railway’s security engineers.
While hackers used automated agents to examine multiple possible entry points simultaneously, the company’s engineers worked to close vulnerabilities and secure affected systems. Railway described the incident as a continuous struggle involving multiple attack routes rather than a single breach requiring one security fix.
How Were $740,000 in Charges Generated?
Investigators discovered that the attackers specifically searched for authentication credentials belonging to artificial intelligence service providers.
Some searches also targeted cloud infrastructure, databases and payment service credentials. The stolen AI credentials were subsequently used to generate approximately $740,000 in unauthorised AI usage charges.
Railway said it was working with affected providers to secure reimbursements and would cover charges that providers declined to refund. The company believes the attackers intended to obtain AI credentials for resale or use in AI model distillation.
Was Customer Data Stolen?
Railway said its investigation found no evidence that attackers downloaded customer Git repositories or accessed customer databases.
However, the compromise of internal infrastructure and decrypted environment variables created potential exposure of sensitive authentication information. The company confirmed that the attackers were fully removed from its systems on October 21 and that the exploited vulnerabilities had been remediated.
Railway had initially disclosed the security incident on October 22, advising customers to rotate their secrets following the discovery of unauthorised access.
Are Other AI Platforms Being Targeted?
Railway linked the incident to a broader series of cyberattacks targeting artificial intelligence development platforms.
Security researchers have identified the campaign as Black October, involving attempts to steal credentials and exploit infrastructure supporting AI applications. Other platforms reportedly targeted during the same period include Northflank, OpenCode, Warp and Lightning AI.
The incident highlights how stolen AI service credentials can expose technology companies and their customers to substantial financial losses without attackers necessarily gaining access to customer databases. It also demonstrates the growing role of automated AI tools in accelerating cyberattacks against cloud infrastructure and developer platforms.
