Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges
Hackers used AI agents and build system flaws to steal API keys and rack up $740,000 in charges.
Railway disclosed an attack where threat actors used AI agents, a build system flaw, and cloud access mistakes to steal customer secrets, leading to an estimated $740,000 in unauthorized charges. The attack involved exploiting a flaw to escape build system isolation, gaining access to credentials and internal code, which then allowed AI agents to search for weaknesses. A subsequent OIDC trust misconfiguration exposed further cloud credentials, enabling the attacker to decrypt secrets and access AI provider keys, likely for LLMjacking attacks.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Railway?
Get an email when a new story names Railway, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRailway suffered a chained attack where a flaw in build system isolation allowed threat actors to escape the sandbox and access customer secrets and internal code. A subsequent OIDC trust misconfiguration compounded the damage by exposing cloud credentials, enabling decryption of stored secrets and theft of AI provider API keys — likely used for LLMjacking, running unauthorized AI workloads at the victim's expense. This incident illustrates how a single misconfiguration in a CI/CD or cloud trust boundary can cascade into catastrophic credential exposure. The scale of financial harm — $740,000 in unauthorized charges — underscores that secrets stored in build and cloud environments are high-value targets requiring strict isolation and least-privilege controls.
What helps against this
How we list vendors- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Cloud security posture management (CSPM and CNAPP)
Misconfigured cloud storage and over-permissive roles get caught before they leak.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — LLMjacking