San Francisco’s Railway says hackers stole customers’ AI keys and ran up an estimated $740,000 in charges
The cloud company says it will cover charges that AI providers won’t refund. It calls the attack one of a string of thefts of AI keys, including at San Mateo’s Fireworks AI.
Hackers who broke into Railway, a San Francisco company that runs websites and apps for software developers, decrypted stored passwords and keys from up to about 100,000 customer workspaces and used stolen keys for AI services to run up an estimated $740,000 in charges, the company said in a Nov. 10 incident report.
Railway is working with AI providers on refunds and says it will cover the losses itself when a provider won’t. The AI service OpenRouter declined refunds, so Railway says it will pay those costs. Customers can report charges they didn’t make through a form linked in the report.
Why it matters
Developers often store API keys, long passwords that let their software use paid services such as OpenAI’s or Anthropic’s AI models, on hosting platforms like Railway. Anyone holding a key can run up the owner’s bill. Railway says the attacker searched specifically for AI keys, which it believes were passed on for distillation, the practice of training a new AI model on a stronger model’s answers.
Railway called the break-in one of a series of attacks on platforms that hold AI keys. OpenCode, Warp, Fireworks AI and others disclosed similar thefts between Oct. 6 and Oct. 23, the report says.
What happened
On Oct. 20, the attacker used a previously unknown flaw in Railway’s shared system for building customers’ apps to steal an internal password. Using a copy of Railway’s own source code, the attacker found a misconfigured cloud setting, reached a machine holding a decryption key and, over about 2½ hours on Oct. 21, decrypted some customers’ stored settings. Railway says the attacker used AI models stripped of their safety limits to probe many routes at once.
Railway expelled the attacker on Oct. 21, paused app builds twice, replaced its internal credentials and logged out every user. It reset linked-account tokens, digital keys connecting Railway to services such as GitHub, for 1,852 users and found no logins using stolen credentials. It reported the attack to the FBI’s Internet Crime Complaint Center and hired an outside forensics firm.
Limits
The 100,000 figure is an upper limit, not a count of confirmed victims, and the $740,000 is Railway’s estimate. Railway has not said who the attacker is.
Sources: Railway incident report, Nov. 10, 2026; Railway terms of service (company address).