The Pulse
Railway Says AI-Key Hunt Put Up to 100,000 Workspaces at Risk
Railway says attackers sought AI-provider API keys in an October intrusion that reached internal systems and exposed some stored environment variables. The company estimates variables in up to 100,000 workspaces may have been compromised an
AI.info Team · Written with AI · fact-checked ·
Railway says an attacker who breached its internal systems was seeking AI-provider API keys, and that environment variables in up to 100,000 workspaces may have been compromised. The company’s preliminary report, published October 22, puts that upper bound at 1.85% of its workspaces; it does not say that credentials in all 100,000 were decrypted or taken.
The intrusion disrupted builds and some Railway services as the company shut down infrastructure and investigated. In a status update on October 23, Railway said builds were operational but could take longer than usual, while new signups remained paused. Existing customer deployments stayed online during the incident, the company said.
Railway ties the intrusion to an AI-key search
Railway’s report says the company detected abnormal activity on October 20 and later found evidence of an attempt to escalate access across multiple parts of its system. Its timeline says the intruder pulled encrypted secrets, then used credentials to reach a continuous-integration environment and decrypt artifacts that held additional API access. Railway says investigators found evidence of an unauthorized query of encrypted environment variables, with a subset decrypted.
“Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks.”
Jacob Cooper and Angelo Saraceno, Railway
Distillation uses outputs from an existing model to help train another model. Railway has not named an attacker or established who was behind the campaign. Its report says the investigation remains underway and that the company will publish a follow-up when it concludes.
100,000 is a ceiling, not a confirmed victim count
Railway says at most 1.85% of workspaces—about 100,000—had environment variables that may have been compromised. The company could not determine from the query alone which specific variables were decrypted. It also warned that the number of customers contacted as high risk is larger than that 1.85% estimate, because its outreach reflects its assessment of who may have been targeted, not only confirmed decryption.
Notifications from providers do not by themselves mean an individual customer’s credentials were exposed. Railway says it contacted vendors including GitHub, GitLab, Anthropic, OpenAI, OpenRouter and Stripe, and shared keys more broadly with some vendors as a precaution. The company says Railway user accounts were not accessed; it has not ruled out access to customer source code and says it will address that question in its final forensic report.
Credential rotation remains Railway’s advice
Railway recommends that customers who signed up before October 21 rotate keys stored on the platform. Its broader guidance calls on users to revoke and reapply sensitive environment variables, review service activity and check relevant provider audit logs. The advice applies even to customers who have not received a direct notice: Railway’s October 23 status update says workspaces outside its higher-risk groups are not confirmed safe from compromise.
By 18:57 UTC on October 23, Railway said it had completed notifications to users whose workspaces met its increased-risk criteria based on findings available at that time. The status page said new findings could change that assessment and prompt further contact. At 20:43 UTC, Railway reported that builds were running, though some could take longer than usual; its support and community site remained unavailable.
Railway says it rebuilt parts of its infrastructure
The company says it rolled internal keys, rotated credentials for its storage buckets and rebuilt infrastructure tooling from validated source. It also accelerated a move to a newer, single-tenant builder environment. Railway says it engaged external incident-response experts and authorities, while withholding some technical details as the investigation continues.
The preliminary account leaves key questions open, including the full route of the intrusion and whether source code was accessed. Railway’s next forensic report is expected to address those questions; for customers, its immediate instruction is to replace sensitive credentials stored before October 21 and review activity tied to them.