Cloud hosting firm Railway says recent breach leads to $740,000 in fraudulent AI charges

Attackers exploited a zero-day in Railway’s build infrastructure to steal customer AI API keys and cloud credentials Stolen keys fueled roughly $740,000 in unauthorized AI usage, likely supporting large-scale model training and automation Railway spent 26 hours battling AI-assisted attackers before

<![CDATA[ <article> <ul><li><strong>Attackers exploited a zero-day in Railway’s build infrastructure to steal customer AI API keys and cloud credentials</strong></li><li><strong>Stolen keys fueled roughly $740,000 in unauthorized AI usage, likely supporting large-scale model training and automation</strong></li><li><strong>Railway spent 26 hours battling AI-assisted attackers before containing the intrusion and rotating credentials</strong></li></ul><p>US-based cloud hosting company Railway said threat actors abused a previously unknown vulnerability to break in, steal user credentials, and rake up hundreds of thousands of dollars in unauthorized AI usage.</p><p>The company managed to throw out the criminals and harden its infrastructure, but not before witnessing an epic 26-hour bot-versus-bot battle.</p><h2 id="railway-gets-attacked">Railway gets attacked</h2><p>At its core, Railway is a cloud hosting company, but one designed primarily for developers to build, deploy, and run applications without having to manage much of the underlying infrastructure. </p><p>Its key services include running websites and APIs, hosting databases and deploying PostgreSQL and MySQL, connecting GitHub repositories and deploying new code automatically, and handling containers, networking and resource allocation. </p><p>Similar to other cloud providers, its build infrastructure uses a multi-tenant architecture, meaning a single device hosts multiple builds which should, in theory, be in full isolation from each other on the same virtual machine.</p><p>Many of its customers are developers and businesses using AI services, with API keys stored as environment variables on the platform. This allows the hosted applications to communicate with AI models more easily. </p><p>Now, in an incident report, Railway said unidentified threat actors used a <a href="https://www.techradar.com/best/best-malware-removal" target="_blank">zero-day vulnerability</a> in its build infrastructure to “partially escape filesystem isolation” and read some of the files stored on the host virtual machines. In these files were apparently credentials the build servers use to authenticate to a subset of internal systems. </p><p>“After they acquired this credential, the attacker attempted but initially failed to use it in a variety of systems,” the report stated. However, they eventually realized the credential allowed access to Temporal, the company’s internal task management system. There they found a copy of Railway’s internal codebase in which they discovered a misconfigured authentication mechanism that allowed them to nab temporary cloud credentials.</p><p>With these, they accessed other internal systems, including credentials needed to access a production database with encrypted customer environment variables, as well as information on how to decrypt them. </p><h2 id="api-keys-for-ai-services">API keys for AI services</h2><p>The attackers were apparently mostly interested in API keys of businesses using AI services. Using the keys, they were able to access paid AI services, leaving the victims to pick up the tab. </p><p>And quite the tab it was - roughly $740,000 charged for using coding agents and AI training pipelines. Railway believes whoever obtained the keys likely sold them on the black market, possibly to support model distillation. </p><p>Model distillation is when a smaller <a href="https://www.techradar.com/best/best-ai-tools" target="_blank">AI model</a> is trained to imitate the capabilities and responses of a larger, more powerful model. This is usually done by sending a large number of queries to the original model, and using whatever it returns as training data for the smaller ones. Although it is impossible to prove, many analysts believe this is how <a href="https://www.techradar.com/pro/security/fbi-nsa-warn-chinese-ai-companies-like-deepseek-and-alibaba-are-reportedly-carrying-out-industrial-scale-distillation-campaigns-to-boost-their-models" target="_blank">Chinese models are able to compete with US ones</a>. </p><p>Railway estimates environment variables of up to 100,000 customer workspaces could have been decrypted during the incident, but stresses the number represents an upper limit rather than a confirmed number of compromised accounts.</p><p>The company said the attack started on October 20 at roughly 07:28 UTC, and ended at 09:24 UTC on October 21, some 26 hours later. During that time the engineers, working in shifts, saw the attacker probing many potential routes in parallel, as Railway was hardening them, also in parallel. “The escalating situation became a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz,” it said in the report.</p><p>Railway said it has since closed the exploited vulnerabilities, rebuilt affected infrastructure, and rotated compromised credentials. It is also working with AI providers to refund fraudulent charges, promising to cover losses that the providers refuse to reimburse.</p><p><em>Via </em><a href="https://www.bleepingcomputer.com/news/apple/railway-breach-leads-to-740-000-in-fraudulent-ai-charges/" target="_blank"><em>BleepingComputer</em></a></p> </article> ]]>