Platform-as-a-Service company Railway disclosed Wednesday that an unauthorized third party may have gained access to encrypted environment variables belonging to customers and, in certain instances, obtained the unencrypted information. The company identified unusual activity tied to systems storing customer environment variables—user-defined pairs that hold sensitive information like API keys, database credentials, or feature flags. Railway said the impact affects a subset of users, though it didn't provide an exact count.
The breach has already produced tangible consequences. Security researcher Taylor Monahan reported that the incident enabled attackers to drain cryptocurrency wallets whose private keys were stored on Railway. The first documented cryptocurrency theft transaction took place at 7:36 p.m., at least two hours before Railway officially disclosed the incident. Railway has since rotated all bucket credentials and invalidated API tokens in response, while restoring builds for Pro and Enterprise workspaces. Builds for Hobby, Free, and Trial workspaces have now been made available as well, though new signups remain temporarily paused while the company concentrates on existing customers. Some builds continue to fail more frequently than typical, and many deployments remain queued with longer-than-usual wait times.
Railway said the incident appears to be part of a broader campaign targeting platform companies with the ultimate aim of compromising artificial intelligence inference providers. The company has notified upstream providers to proactively revoke the keys to prevent their misuse. Customers are being urged to rotate environment variables—including any API keys stored in Railway and private registry credentials—and to review logs for unusual activity. According to Dick O'Brien, principal intelligence analyst at the Symantec Threat Hunter Team, "API keys for AI models are valuable because anyone holding one can run inference at the owner's expense."
The Railway breach sits within a rising tide of attacks where threat actors gain unauthorized access to cloud environments to run Large Language Models at victims' expense, a technique called LLMjacking. In one case documented by Wiz earlier this week, attackers compromised privileged Google Cloud Platform credentials and linked external, attacker-controlled projects to the victim's internal billing accounts. The attack leveraged sponsored ads on Google Search as an initial entry point, deceiving users searching for common terms like "google cloud" to fake login pages that harvested credentials and multi-factor authentication codes. Symantec's Threat Hunter Team has observed attackers targeting exposed LLM endpoints to power an autonomous cybercrime operation capable of scanning the internet, exploiting vulnerabilities, stealing credentials, and mining cryptocurrency without human intervention for up to 100,000 steps, using an offensive AI agent operating in what researchers call "Skynet mode." The goal is free inference: rather than simply using AI to generate malicious content, the agent uses hijacked AI models to plan and direct attacks while shifting compute costs to the legitimate owner. O'Brien told The Hacker News there's no evidence the activity his team observed and the Railway incident are linked, though both share a common thread around the value of stolen API keys for AI models.
Railway said it's continuing to send notification emails to impacted customers as it works through the incident response. The company has urged users to take immediate precautionary steps to secure their credentials and monitor for unusual activity. Platforms holding environment variables have become high-value targets precisely because they centralize access to sensitive keys that unlock both traditional infrastructure and increasingly expensive AI compute resources. The economics of stolen inference time create powerful incentives for attackers willing to invest in sophisticated campaigns that span multiple platforms and exploit chains of trust between providers and customers.