Railway October Incident Report: AI Agent Speed, Build Escape, and $740,000 in Stolen Key Spend

On November 10, 2026, Railway published its full incident report for the October platform breach—not a new intrusion, but the forensic story behind the October 21 disclosure. The write-up names what secondary coverage had only hinted at: the defender–attacker contest became a race of agent speed, with Railway engineering working against abliterated models and a harness similar to ARTEX (per Wiz's Black October research). The attacker escaped multi-tenant build isolation, abused Temporal build histories, copied Railway's internal monorepo, then exploited an erroneous OIDC trust binding to decrypt customer environment variables—prioritizing AI provider key names in database queries. Railway estimates ~$740,000 in unauthorized spend on stolen keys and says it will backstop refunds when providers refuse. If you deploy apps or agents on Railway, read this for the mechanism, not only the rotation checklist in our earlier breach guide.

explainx.ai has the full news timeline for customer-facing recovery steps alongside this vendor report.

TL;DR

Condensed timeline (UTC)

Image: Railway

Railway's report compresses a multi-day parallel remediation. The table below tracks the verified entry and decryption windows from the November 10 report and its preliminary predecessor.

Forensics also moved two facts that the October preliminary post had wrong: decryption began 04:42 UTC on October 21, not after 05:27, and dummy-account probing started October 18, two days before the page that opened the public timeline.

Attack chain, step by step

Step 1 — Build isolation partial escape

Railway's builders at the time ran multiple isolated builds on one VM. At 07:28 UTC on October 20, the attacker used a previously unknown flaw to partially escape filesystem isolation and read host files. That exposed a credential build servers use to authenticate for registry pushes and related internal calls.

The on-call engineer tied anomalous artifact registry API traffic (paged at 13:58 UTC) to that compromised build path and stood up a 24/7 response with audit logs and traces watching the attacker move.

Step 2 — Temporal trust misuse and monorepo map

Railway's build pipeline used a self-hosted Temporal cluster. Build task histories can carry scoped GitHub app tokens, build environment variables, and execution metadata. The stolen build credential was meant only for finishing builds, but Railway's Temporal deployment accepted it as a broader Temporal client, letting the attacker call APIs and read a limited subset of other builds' histories.

One retrieved build deployed station.railway.com from Railway's internal monorepo. Because the credential could fetch cached repository snapshots, the attacker obtained a copy of that monorepo—a privileged map of how Railway works. Railway says this enabled agent fanouts to hunt exploits and move laterally quickly. Until this point, Railway reports no customer repository downloads.

Step 3 — Code-driven re-entry and OIDC trust error

After Railway revoked the build credential, the attacker re-probed using knowledge from the stolen codebase—hitting dormant endpoints with no live references, which tipped defenders that source had leaked.

The second foothold was CI/CD short-lived cloud credentials for production deploys. The attacker found an erroneously defined OIDC binding and at 03:26 UTC on October 21 obtained a short-lived cloud credential.

Step 4 — Orchestration host, database envelopes, KMS decrypt

That credential unlocked internal deploy secrets in the cloud environment, including an SSH key for fleet orchestration machines and a longer-lived credential that—combined with VPC access—could read envelope-encrypted environment variables from Railway's production database.

The attacker SSH'd to an orchestration node that held a KMS-capable decrypt credential on disk for provisioning workloads. Between 04:07 and 05:21 UTC, they pulled encrypted envelopes. Database logs show regex queries prioritizing AI provider variable names and workspaces with many variables.

Between 04:42 and 07:15 UTC, they authenticated to Railway's key management service and decrypted some envelopes—not all variables in the upper-bound workspace count.

Railway stresses this was credential abuse, not broken envelope encryption: per-environment data keys still depend on a root key that cannot leave the upstream KMS.

Step 5 — Agent-speed probing and LLMjacking economics

Railway's most security-relevant characterization is operational, not cryptographic: defenders and the attacker were closing and opening routes in parallel, and the situation became "a contest of agent speed" against abliterated models and a harness similar to ARTEX (WorkOS tied a separate October campaign to ARTEX-class tooling; Google Mandiant documented ARTEX-style offensive harnesses).

Intent, per Railway forensics: AI provider credentials for distillation and resale through distributed transfer stations—the same economics Wiz labeled LLMjacking across OpenCode, Warp, Fireworks AI, and other October platform disclosures Railway cites in the same paragraph as its own incident.

Customer-shared IoC reports afterward included coding-agent requests, agent-behavior reviews for training data, and scoring-system checks—consistent with stolen keys entering resale or evaluation pipelines. Railway has not established whether the original intruder operated those services.

Customer impact and refunds

Railway's November report refines numbers from October press summaries (Cyber Security News echoed the same mechanism):

• ≤1.85% of workspaces (~100,000) could have had some variables decrypted (environment-level upper bound).
• 353 builds' Temporal histories read on October 20, including sealed variables in histories.
• 1,852 users had linked-account tokens (BYOK agent keys, GitHub OAuth) in the decrypted set; all reset, no Railway account logins with stolen creds observed.
• ~$740,000 estimated unauthorized AI token spend; Railway coordinates provider refunds and covers gaps (explicitly including OpenRouter when the provider will not refund).

Provider notes in the report (October 22 snapshot): AWS Bedrock and Google Gemini fraud refunds via account teams; OpenAI and SpaceXSI via support bridges; Anthropic costs backstopped by Railway while discussions continue.

Railway asks customers to report fraudulent charges via its station.railway.com form linked from the report.

What Railway changed

Selected hardening from the report's security updates section:

• Builds: dedicated ephemeral VM per build, narrowly scoped registry-push credentials; exploited shared builder generation retired.
• CI: rebuilt with fine-grained access, 2FA/biometrics on critical paths, segmented networks, SIEM alerting.
• Secrets: centralized decrypt with audit logging; only the secrets service holds data-key decryption capability; per-service decrypt scoping.
• Access: short-lived, JIT credentials; deprecated systems decommissioned to shrink attack surface.
• Process: incident runbooks will include a fixed window to assess impact, then mandatory broad notification even if eviction is incomplete.

Railway also says it accelerated a pre-planned per-VM builder generation originally slated for the week of October 26, causing capacity pain when customers simultaneously rotated secrets.

What this means if you run AI coding agents

This incident is not prompt injection in your IDE. It is PaaS secret storage plus automated offensive agents stress-testing a platform. Still, coding-agent teams feel it in four places:

1. Keys in Railway env vars — If agents, CI, or MCP gateways read OPENAI_API_KEY-style variables from Railway, assume exposure if your workspace sits in Railway's high-risk cohort. Rotate at the provider, update Railway, then revoke old keys. See our first-24-hours vendor breach runbook.

2. Copies on laptops — Agents often duplicate .env files or export keys into local MCP configs. Railway rotation does not touch those copies. Grep repos and agent configs; use API key leak patterns and provider audit logs.

3. Downstream abuse shape — Stolen Railway keys showed up as coding-agent traffic and training-evaluation workloads. If your org runs Claude Code, Codex, Cursor, or custom agents against provider accounts also stored on Railway, correlate October 18–21 usage spikes even without a Railway email.

4. Separate Primcloud episode — Railway's employee agent testing against a competitor is a different accountability story; see Primcloud claimed vs verified. Do not confuse it with this October attacker.

5. Hosting agent backends on Railway — If your agent server's secrets lived on Railway during the window, redeploy on the new builder generation and review monitoring patterns for Railway-hosted apps.

What Beam can and cannot do here

Beam is local-first observability for agent harnesses on your machine: it can flag and, with cached enforce policy, deny some PreToolUse actions on Claude Code and Codex (destructive commands, credential reads, obvious exfil patterns) and heuristically scan skills and MCP configs before you run them. It does not monitor Railway's cloud plane, Temporal, or KMS paths, and it does not replace provider-side spend caps or PaaS secret managers. After a platform breach, Beam helps you catch agents still holding old keys locally; it cannot tell you whether Railway decrypted a specific variable.

How this fits Black October

Railway explicitly places its attack in the same October wave as Fireworks AI, OpenCode Console, Warp, and other AI key warehouses documented in Wiz's Black October roundup. The novel lesson in Railway's November report is defender parity: once an attacker holds your internal monorepo and runs parallel agent probes, human-speed incident response alone may not keep up—platform architecture (per-build VMs, OIDC hygiene, Temporal scoping) matters as much as customer rotation.

Frequently asked questions

What did Railway publish on November 10, 2026?

A forensic incident report with the build→Temporal→monorepo→OIDC→KMS chain, agent-speed attacker characterization, customer impact bounds, refund coordination, and security hardening summary.

How many customers had secrets decrypted?

At most 1.85% of workspaces (~100,000) by Railway's logging—an upper bound on environments, not per-variable confirmation.

Were coding agents part of the attack?

Railway describes agent-speed offensive probing during the intrusion and coding-agent-like API abuse after keys leaked; it does not name a specific commercial agent product as the intrusion tool.

Should I still rotate if I got no email?

Railway's October guidance remains: if you stored secrets on Railway before the incident, rotate and review logs; lack of email is not a safety signal.

Did Railway fix the build escape?

Railway says each exploited vector is remediated, with per-build ephemeral VMs and retired shared builder components; third-party vulnerabilities found during the response are in responsible disclosure.

Where is the primary source?

Railway's November 10 incident report and October preliminary report.

Related reading

• NEAR AI SGLang RCE incident scope (update)

• Railway breach rotation guide (October disclosure)

• NEAR AI Cloud inference pause after internal breach

• Northflank control-plane secrets and AI key abuse

• TypeSafe AI joke vs real October attacks

• Zeabur environment variable records breach

• 26,400 live AI keys in public Gitee repos

Primary sources: Railway incident report (Nov 10, 2026) · Railway preliminary report · Cyber Security News summary

Version details, refund policies, and infrastructure descriptions are accurate as of November 10, 2026 UTC. Railway says forensic work with law enforcement and a specialist firm continues; check Railway's blog for amendments.