Railway published a detailed incident report on November 10 describing how attackers chained a build-system escape, lateral movement across internal services, and AI-powered agents to steal customer credentials and run up an estimated $740,000 in unauthorized AI usage1,2,3.
The cloud hosting provider said it believes the hack specifically targeted AI provider keys for resale4. Linked-account tokens belonging to 1,852 users were exposed, including GitHub OAuth tokens and AI agent keys. Railway said it reset the exposed tokens and notified affected users.
The attack chain
The first successful exploit occurred at 07:28 UTC on October 20, when a previously unknown vulnerability in Railway's build infrastructure let the attacker partially escape filesystem isolation and read files on the host machine. Those files exposed a credential that build servers used to access internal services and push completed images.
That credential carried more trust than intended: Railway's Temporal task system accepted it, allowing the attacker to read stored histories from 353 builds, including secrets. Access to cached repository snapshots also exposed Railway's internal codebase. At 03:26 UTC on October 21, an incorrect OpenID Connect trust configuration exposed a short-lived cloud credential. The attacker used it to retrieve internal credentials and an SSH private key, then entered a machine responsible for coordinating customer workloads. That machine had network access to the production database and another credential able to authorize secret decryption.
The attacker retrieved encrypted variables and used Railway's key management service to decrypt some values. Up to 1.85% of workspaces — roughly 100,000 — could have had environment variables decrypted, though Railway said this is an upper limit rather than a confirmed count of workspaces with stolen keys.
Abliterated models and an ARTEX-like harness
Railway engineers detected unusual registry API calls at 13:58 UTC on October 20 and began responding. The company described the ensuing period as a roughly 26-hour battle between its engineers and threat actors using AI-powered agents to identify and exploit vulnerabilities across its infrastructure. Railway said the attacker used models with safety limits removed through an agent framework similar to ARTEX, according to Wiz. The attackers were fully removed from Railway's systems at 09:24 UTC on October 21.
The Railway breach adds to a cluster of reported incidents involving offensive AI agents in cloud environments. ARTEX forks remain publicly available and capable of executing credential attacks at machine speed across multiple industries[1]. A separate incident reported on November 8 involved a jailbroken AI agent running an autonomous multi-week intrusion against a European telecom provider[2].
Railway believes stolen keys reached services that relay or resell AI access, potentially supporting model distillation. The resulting charges reflect what the report calls LLMjacking attacks, where criminals use stolen credentials to consume paid AI services at victims' expense. Railway said it has not established whether the intruder operated those services.
Remediation and scope limits
Railway said all exploited vulnerabilities have since been remediated. The company revoked credentials, rebuilt internal systems, and restored builds for every plan by October 22. Investigators found no Railway account logins using stolen credentials and no evidence of customer database access or customer Git repository downloads.
Railway said it is working with providers on refunds and will cover breach-related charges where providers decline reimbursement. The company advised customers to rotate potentially exposed secrets, review provider usage, and report fraudulent charges.