Railway says 1.85% of its workspaces were hit. That's about 100,000, and the attacker was after AI keys.
The hosting platform's preliminary report puts a number on its October 21 breach and says the attacker went looking for keys to AI services. What it does and doesn't say yet.
Railway’s first public statement on its breach said the damage “may be limited to a subset of users.” A day later the company’s own report put a number on that subset: at most 1.85% of all workspaces, which it says is about 100,000.
That’s a lot of “subset.”
Railway is a hosting platform where developers deploy apps and keep their secrets, things like database passwords and API keys, as environment variables. On October 21 it told customers that an unauthorized party “may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents.” The follow-up, a preliminary report from CEO Jake Cooper and Angelo Saraceno dated October 22, fills in the rest.
What the report says happened
Railway’s monitoring paged an engineer on October 20 at 13:58 UTC for odd latency. The company’s timeline has the attacker escalating privileges in the build infrastructure, being shut out, and then finding other routes in. By the morning of October 21 the attacker had pulled secrets in encrypted form. Then, in the window between 05:27 and 07:25 UTC, it got credentials to Railway’s CI environment and decrypted artifacts that held more API access.
Railway says it read the attacker’s own logs and saw the names of the API keys being searched for. That’s why it called its partners at 09:25 UTC. It names GitHub, GitLab, Anthropic, OpenAI, OpenRouter, Stripe and others as vendors it worked with to revoke keys. For some vendors, GitHub among them, it handed over every key on the platform rather than only the ones it could prove were exposed.
Because the keys were envelope encrypted, Railway says it can’t tell which specific variables in an affected project were decrypted. So its notification list is wider than the 1.85%. It says it’s also contacting customers it judges high risk: workspaces with a huge number of variables, and those holding lots of AI vendor keys.
The one number, and what it leaves open
Take the 1.85% at face value and it means roughly 5.4 million workspaces on the platform, though Railway doesn’t state that total itself. That’s my arithmetic from its two figures. The phrase “at most” also matters. It’s an upper bound on workspaces with variables “potentially compromised,” not a count of confirmed thefts.
What’s still unknown is bigger. Railway says it can’t yet share how the exploits worked. It also hasn’t ruled out that the attacker saw user source code, and promises to confirm that in its final forensic report. The attacker, in its words, didn’t access Railway user accounts.
The company also claims the attacker “had access to abliterated models and substantial compute resources.” Abliterated means a model with its refusal behavior stripped out. That’s Railway’s belief from early evidence, not something outside researchers have confirmed, and I’d treat it as a claim.
Why AI keys, specifically
Railway says the attacker wanted AI provider keys to run “distillation attacks,” meaning using stolen access to pull outputs from a model to train another one. TechCrunch reported that the open-source coding tool OpenCode said it lost more than 1% of its customers’ keys and secrets to a similar attack earlier in the week, and that CISA recently warned about China-based AI companies running large-scale attacks on US firms for that purpose. I couldn’t find a primary source for the CISA warning, so that part rests on TechCrunch.
The motive makes sense even without the attribution. A valid OpenAI or Anthropic key is a prepaid line to expensive compute, and developers paste them into hosting dashboards all the time. The Hacker News also relays security researcher Taylor Monahan’s claim that crypto wallets whose private keys were stored on Railway were drained. Railway hasn’t confirmed that.
What I’d do
If you ever had a project on Railway before October 21, rotate every key stored there, whether or not you got an email. That includes the ones that look unrelated to AI, like database URLs and Stripe keys. Check usage dashboards at your AI vendors for spend you don’t recognize. Railway also revoked its API tokens and GitHub connections, so deploys from CLI or CI will fail until you reconnect and mint new tokens. Its recovery guide walks through that.
This is the second AI-tooling credential scare in two days. The poisoned LiteLLM release we covered on October 22 aimed at the same prize, as our LiteLLM post explains. Two incidents don’t make a trend, but the target is the same both times: the keys sitting in plain reach of a developer’s tools.
I’d like to see Railway’s final report say how a build system led to decrypted secrets. That’s the part other platforms will actually learn from.