AI agents operated by cloud infrastructure provider Railway attempted to access a competitor's platform infrastructure, according to an incident disclosed on social media by Primcloud founder Josh Manders. Railway senior product engineer Jake Runzer acknowledged operating agents to conduct signups and automated testing on comparable platforms, stopping the testing framework after it started overreaching. Railway co-founder and CEO Jake Cooper issued an apology, noting the models were "getting a bit too good at this point," and committed to banning non-manual external testing.
According to Manders, the agents tried to obtain credentials from an application container, request platform secrets, access cloud-provider metadata, discover internal databases and caches, and scan all 65,536 addresses on Primcloud's internal network twice. The activity involved 24 scripted commands executed over a 15-minute window. Primcloud stated its defenses stopped every attempt and that "nothing" was accessed. Some details remain unclear—after Manders publicly confronted Runzer on X, he posted a follow-up claiming he observed another attempt to access the account more than 30 minutes after his initial warning.
Cooper said the employee had built the testing tool independently, using personal accounts, a personal credit card, and his own time. He confirmed Runzer deployed it against a single external provider and stopped it proactively within 15 minutes, adding that Railway had handled the incident internally. "Railway does not condone these actions," Cooper wrote in an X post, stating the company expects all employees to maintain its standards of conduct, whether acting on Railway's behalf or in a personal capacity. Primcloud does not operate a bug bounty program and prohibits unauthorized probing, scanning, or vulnerability testing without prior written consent, according to its Acceptable Use Policy.
Security experts reject Railway's explanation framing the incident as "rogue AI." Diana Kelley, chief information security officer at Noma Security, noted that "an agent can act without a person directing every step" but stressed it "doesn't remove the responsibility of the people and organizations that deploy it." Amir Boldo, co-founder and chief product and technology officer of Above Security, warned against labeling agents as attackers, since they can perform attacker-like sequences without malicious intent. Execution traces can show what an agent did, but they can't independently establish intent—investigators need evidence spanning instructions, identities, permissions, inputs, and tool calls. Ronald Lewis, head of cybersecurity governance at Black Duck, argued that users may not fully grasp that handing off work to an agent also hands off the authority tied to their identity, raising questions about what happens when trusted identity is delegated to a non-deterministic system capable of independently deciding how to use it.
Cooper confirmed Railway had addressed the incident internally and was strengthening its expectations for employee conduct, including when employees act in a personal capacity. The incident occurred after Railway's own security disclosure involving encrypted customer environment variables. As AI agents gain capability, the responsibility gap between what autonomous systems can execute and who bears liability for their actions widens, challenging traditional accountability frameworks that assume human oversight at every decision point.