Hackers steal AI credentials to rack up $740,000 in fraudulent compute costs

The Railway breach details

Cloud hosting provider Railway recently disclosed a security incident where hackers targeted customer credentials to generate massive fraudulent AI costs. As reported by Computerworld, the attackers managed to rack up about $740,000 in charges using stolen keys. The breach was discovered after a 26-hour battle between Railway's engineering team and the intruders.

The hackers initially exploited a previously unknown vulnerability in Railway’s build infrastructure to bypass filesystem isolation. This allowed them to obtain an internal credential and access the company's internal source code. By analyzing this code, the attackers identified further ways to compromise the system and gain deeper access.

The attackers eventually exploited an improperly configured trust relationship to gain access to the infrastructure used to decrypt customer environment variables. While the company was not able to share the exact scale of the exploits, they confirmed that roughly 100,000 workspace credentials were compromised. This represented at most 1.85% of the total workspaces on the platform.

How the theft was executed

The threat actors were highly methodical in their search for valuable data. They specifically looked for AI provider keys by name before searching for other types of information. Their queries also targeted credentials for cloud services, databases, and payment systems. This suggests a focused effort to find high-value assets that could be sold or used for large-scale operations.

Once the keys were stolen, the attackers used them to perform tasks that the legitimate owners never authorized. Customers reported that their keys were used to answer coding questions and perform training-data tasks. These actions were part of a larger scheme to use stolen identities to fuel model distillation. Distillation is a process where knowledge is transferred from a large AI model to a smaller, more efficient one.

Because training one model on another's answers requires millions of questions, a single account performing such a task stands out. By using stolen keys, the thieves were able to spread these questions across thousands of real customers. This allowed them to generate cost-free compute while the original owners were left with the bill. Security experts describe this as a new version of cryptomining with a different output.

The impact on customers

The breach had a wide reach, affecting more than 1,850 users whose linked-account tokens were exposed. These included OAuth and GitHub tokens, which Railway has since reset for all affected parties. The company worked with several major providers, including OpenAI, Anthropic, and Stripe, to revoke the potentially compromised keys as quickly as possible.

Railway is currently working to reimburse customers for the fraudulent charges, including those that some providers might initially decline to refund. They have advised users to revoke and reapply any sensitive environmental variables that were stored on the platform before October 21. Users are also encouraged to remove public network access to databases and review their audit logs for unauthorized activity.

The incident highlights a growing risk where machine-held identities become primary targets for theft. Because these keys are cheap to harvest at scale, attackers can target a single hosting provider to gain access to many companies at once. This makes protecting machine identities as critical as protecting traditional financial information like credit card numbers.

Infrastructure and security fixes

In response to the attack, Railway took several significant steps to harden its environment. They shut down all potentially compromised internal tooling and moved to a new generation of infrastructure. The company also rebuilt the tooling used to run its infrastructure and rolled all keys multiple times to ensure intruders were evicted.

A key part of the new security strategy involves moving to short-lived credentials and logging every instance of decryption. This change is intended to limit the window of opportunity for any future stolen keys. Railway also added functionality to mass revoke app permissions in the event of suspicious activity to provide faster responses to similar threats.

Security researchers suggest that customers should treat every secret stored on a platform as stolen until it has been rotated. They recommend setting hard spending caps and usage alerts on every AI key to limit the damage a thief can do. By scoping each key as narrowly as the provider allows, users can prevent a single stolen credential from being used for massive, unauthorized compute tasks.