[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmXt1NmytbvnqOc--Ino9kxofDTmCJ4-wbxlWjgpZ4YA":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"31764df7-540a-4408-a840-6bed8667b67c","build-system-escape-and-oidc-misconfiguration-let-attackers-steal-740k-in-ai-api-keys","a882c8db-bcf6-497d-b543-b2468a05e6e8","Build System Escape and OIDC Misconfiguration Let Attackers Steal $740K in AI API Keys","Railway suffered a chained attack where a flaw in build system isolation allowed threat actors to escape the sandbox and access customer secrets and internal code. A subsequent OIDC trust misconfiguration compounded the damage by exposing cloud credentials, enabling decryption of stored secrets and theft of AI provider API keys — likely used for LLMjacking, running unauthorized AI workloads at the victim's expense. This incident illustrates how a single misconfiguration in a CI\u002FCD or cloud trust boundary can cascade into catastrophic credential exposure. The scale of financial harm — $740,000 in unauthorized charges — underscores that secrets stored in build and cloud environments are high-value targets requiring strict isolation and least-privilege controls.","**Immediate actions:**\n- Audit and harden all OIDC trust configurations to restrict token acceptance to explicitly defined, minimally scoped audiences and subjects.\n- Rotate all secrets and API keys stored in the build environment and audit which were potentially exposed during the incident window.\n- Enforce strict build sandbox isolation using containerization and kernel-level controls (e.g., seccomp, namespaces) to prevent escape.\n\n**Long-term improvements:**\n- Apply the principle of least privilege to all cloud IAM roles assumed via OIDC, ensuring build pipelines cannot access production secrets.\n- Adopt a secrets management platform (e.g., HashiCorp Vault, AWS Secrets Manager) with dynamic, short-lived credentials instead of static API keys.\n- Regularly penetration-test build and CI\u002FCD pipeline isolation to discover escape vectors before attackers do.\n\n**Detection measures:**\n- Implement real-time alerting on anomalous cloud API usage, especially unexpected AI provider API calls or sudden spend spikes.\n- Log and monitor all secret access events within the build environment and cloud credential vending systems to detect unauthorized retrieval.\n- Set hard budget alerts and usage quotas on AI provider accounts to limit the financial impact of LLMjacking attacks.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 SI-17: Fail-Safe Procedures","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed","MITRE ATT&CK T1552: Unsecured Credentials",{"CIS Control 6: Access Control Management":18,"MITRE ATT&CK T1552: Unsecured Credentials":19,"NIST SP 800-53 SI-17: Fail-Safe Procedures":20,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":21,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed":22},"CIS Control 6 requires least-privilege access and strict control over credentials; the overly broad cloud IAM trust granted via OIDC directly violated this principle and enabled lateral movement to production secrets.","The attackers leveraged the build system escape and OIDC misconfiguration to locate and extract API keys and cloud credentials stored in accessible environments, matching this technique's description of harvesting unsecured credentials.","The build system lacked adequate containment controls to prevent an escaping process from accessing sensitive credentials, which SI-17 addresses by requiring systems to default to a secure state upon failure or unexpected behavior.","The OIDC trust misconfiguration and build system isolation failure are exactly the kinds of insecure default or improperly scoped configurations that CIS Control 4 requires organizations to identify, harden, and maintain.","The OIDC trust relationship granted broader cloud access than intended; this control explicitly requires that access entitlements be scoped, reviewed, and enforced to prevent exactly this kind of privilege overreach.","published","2026-11-10T18:21:05.521048+00:00","2026-11-10T18:21:05.506+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Frailway-details-data-breach\u002F","railway-reveals-how-hackers-used-ai-agents-to-steal-api-keys-and-rack-up-740-000-9b12bd","Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":38,"name":39,"slug":40,"description":41,"color":42},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[45,49,53],{"slug":46,"name":47,"problem":48},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak."]