Railway spent October 20 and 21 fighting an attacker that never slept and probed a dozen routes at once — because it wasn't a person. It was a swarm of AI agents.

That's the picture in Railway's full incident report, published Tuesday. The cloud hosting platform says the attacker began probing its build infrastructure on October 18, then at 07:28 UTC on October 20 exploited a previously unknown flaw to partially escape the build system's file isolation. That yielded an over-trusted build credential: according to Cyber Security News, Railway's Temporal task system accepted it, letting the attacker read stored histories from 353 builds — secrets included.

Worse, the credential could fetch cached repository snapshots, so the attacker walked off with a copy of Railway's own monorepo. "This gave the attacker a privileged view into how Railway works," Railway wrote, "enabling them to run agent fanouts, find any exploit, and move laterally with significant speed." The agents ran abliterated models — safety limits stripped — through an ARTEX-like harness, according to security firm Wiz.

The monorepo paid off. Scanning the code, the agents found a misconfigured OIDC trust binding, and at 03:26 UTC on October 21 they used it to grab a short-lived cloud credential, then an SSH private key, then a machine that could decrypt customer secrets. Between 04:42 and 07:14 UTC they decrypted a subset — and their database queries were specifically hunting AI provider keys, matched by regex.

The scale: at most 1.85% of workspaces — about 100,000 — could have had environment variables decrypted. That's an upper bound, not a confirmed count. Linked-account tokens for 1,852 users were reset, and no customer databases were accessed. The bill: roughly $740,000 in unauthorized AI spending — classic LLMjacking — which Railway says it will cover where providers won't refund it.

Railway believes the intent was distillation: stolen keys funneled to "distributed transfer stations" that resell AI access for training. It wasn't alone — OpenCode, Warp, and Fireworks AI disclosed similar key thefts between October 6 and 23, part of what Wiz calls "Black October."

The lesson is blunt: AI provider keys are now the crown jewels, and the platforms holding them are being attacked by the same technology they serve. Railway's advice is unglamorous — rotate secrets, review provider usage, report fraudulent charges. The agents already did the glamorous part — for the other side.

— via Cyber Security News