Cloud platform Railway says hackers sought AI provider keys in breach still under investigation

Railway, a San Francisco-based cloud platform used by tens of thousands of software developers to deploy applications, says a cyberattack discovered on October 21 was aimed at stealing credentials for artificial intelligence providers such as OpenAI, Anthropic and Google, rather than at conventional customer data. Nearly a week later, the company's forensic investigation remains open, new customer signups are still paused, and Railway has told users it will not reimburse fraudulent AI charges run up on their accounts.

The intrusion is the second disclosed this month in which hackers broke into a developer-facing cloud platform specifically to harvest application programming interface, or API, keys that unlock access to large language models. Railway has said it believes its breach and a similar one at the AI coding tool OpenCode five days earlier are connected to "a series of attacks recently targeting platform companies," according to the company's October 21 disclosure, with the apparent goal of feeding stolen access into so-called distillation attacks against frontier AI models.

What Railway says happened

Railway's own account, laid out in a preliminary incident report first published October 22 and updated as recently as Monday, describes an attack window running from the morning of October 20 through the early hours of October 22, Coordinated Universal Time. The company says an intruder exploited a privilege-escalation flaw in its build infrastructure to move from a foothold in that system into other internal services. From there, the attacker obtained continuous-integration credentials, used them to decrypt some stored build artifacts, and eventually ran an unauthorized query against the database holding customers' encrypted environment variables — the hidden settings where developers typically store passwords, database credentials and AI provider keys.

Railway says a subset of those variables was successfully decrypted before its engineers cut off the intruder's access, which the company says it confirmed by October 22. The platform's public status page tracked the response in real time: deployments and new builds were paused while existing customer applications kept running, and full service was not restored across all account tiers until that evening.

In its clearest statement of motive, Railway wrote that its "early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks" — the practice of using an API connection to a commercial model to generate large volumes of its outputs, which are then used to train a cheaper, unlicensed copy. Railway added that it believes the attacker already had access to "abliterated models," a term for open-weight AI systems that have had their built-in safety refusals stripped out, along with "substantial compute resources" to put stolen keys to immediate use.

The numbers, and what is still unknown

Railway says its analysis so far indicates that at most 1.85 percent of all workspaces on the platform — roughly 100,000 by the company's own count — had some environment variables potentially exposed. Because Railway could not immediately determine which specific secrets had been decrypted, it notified outside AI vendors about every key stored on the platform as a precaution, a step that triggered mandatory credential resets for more than 100,000 users, a far larger group than those ultimately confirmed to be at risk.

The company says it has found no evidence the intruder accessed Railway user accounts themselves. It has been less categorical about source code: Railway's report states it is "not ruling out that they accessed user source code" and that the question will be addressed in a final forensic report that has not yet been published. Also unresolved, as of the October 26 update to Railway's report, is when new customer signups — suspended since the breach — will reopen; the company says only that it expects to lift the pause "this week."

"Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks."

A pattern across developer platforms

Railway's framing points to a wider trend rather than an isolated incident. On October 17, OpenCode, a separate company that sells a hosted console for an open-source AI coding assistant, disclosed that hackers had exploited an old system it was in the process of shutting down to reach a subset of customer accounts. OpenCode said the intrusion affected 1.4 percent of Console users who had linked external AI provider keys, and framed the episode, as BleepingComputer reported, as part of the same wave of AI-distillation-driven credential theft. OpenCode co-founder Dax Raad said the company's open-source command-line tool and desktop app were not affected, because keys entered there never reach OpenCode's own servers.

The fallout at OpenCode was immediate and financial. According to TechCrunch's reporting, several affected users said attackers ran up unauthorized charges on their AI accounts overnight, with some describing total losses above $1,000 before the keys could be cut off. Anthropic and Google both moved to block the specific keys they believed had been exposed, while OpenAI said it worked with OpenCode to restore service and refund customers for API credits consumed by the attackers.

Railway occupies a similar niche in the developer-tools market. The company, which positions itself as a modern alternative to Heroku, Vercel and Netlify for deploying backend applications, raised a $100 million Series B round in January led by TQ Ventures. Chief executive Jake Cooper has said the platform serves roughly 100,000 paying users across 25,000 businesses, according to a profile by TechTarget. That customer base increasingly includes startups building products on top of commercial AI models — exactly the kind of account, holding both payment-linked API keys and significant usage budgets, that Railway's own account of the attack suggests made it, and platforms like OpenCode, attractive targets for credential thieves chasing AI access rather than financial data.

What Railway and customers are doing now

Railway's remediation has gone beyond the immediate credential rotation it asked of customers in the hours after the breach. The company says it has rolled every internal key, storage-bucket credential and GitHub App installation tied to its own infrastructure, moved its build system onto a newly architected, single-tenant environment, and rebuilt its internal tooling from freshly validated source code. It has also added a capability to mass-revoke application permissions automatically if it detects suspicious activity in the future, a direct response to how long the intruder was able to operate inside its build pipeline before being cut off.

For customers, Railway's guidance has remained consistent since the first disclosure: rotate every secret stored on the platform, starting with database passwords and AI provider keys; remove public access to any exposed databases; and review provider-side usage logs, including on services such as Docker Hub and GitHub, for signs of unauthorized activity. The company has been explicit that it will not cover losses from fraudulent AI usage charged against exposed keys, directing affected users instead to dispute the charges with the AI vendor itself and to Railway's own support channel for case-by-case help.

Railway has not said who is behind the intrusion, whether it has heard from the attacker, or whether any ransom demand was made, and TechCrunch noted those questions remained unanswered as of its reporting. The company's final forensic report, which it says will settle the open question of whether source code was exposed, has not been published. Until it is, the standing advice from both companies has not changed: customers of Railway, OpenCode and other developer platforms that store AI credentials on their behalf should treat any linked AI provider key as compromised and assume it may already have been used to generate unauthorized model traffic.