"This was not a single breach followed by a single fix. The attacker probed many potential routes, in parallel, with Railway similarly hardening the routes in parallel," Railway said.
Railway's forensic timeline: October 20–22
Railway traces the intrusion to October 20, when attackers exploited a previously unknown vulnerability in its build infrastructure to escape filesystem isolation and obtain an internal credential. Using that credential, the threat actors accessed stored build histories and retrieved a copy of Railway's internal source code. The attackers analyzed that code to find additional routes into the platform, then exploited a second vulnerability—an improperly configured trust relationship—to obtain credentials used to decrypt customer environment variables.
Railway says the intrusion evolved into roughly a 26‑hour engagement between its engineers and the attackers, who used AI‑powered agents to identify and exploit weaknesses while defenders worked to harden systems in parallel. According to the company, attackers were fully removed from Railway systems on October 21, and Railway disclosed the incident to customers on October 22. In a new incident report published today, Railway confirmed details of the intrusion and its scope.
Scope: environment variables, linked tokens, and $740,000 in fraudulent charges
Railway's report states the attackers obtained decrypted customer environment variables for at most 1.85% of workspaces—approximately 100,000 workspaces. The company emphasizes this figure is the maximum number of potentially impacted workspaces, not the confirmed number whose secrets were stolen.
The stolen credentials were used to generate approximately $740,000 in unauthorized AI usage. Railway is working with affected providers to obtain refunds for customers and has committed to cover charges that providers decline to refund.
The breach also exposed linked‑account tokens belonging to 1,852 users, including GitHub OAuth tokens and AI agent keys; Railway reset those tokens and notified affected users. The company reports no evidence that attackers downloaded customer Git repositories or accessed customer databases.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadAI‑powered agents and the "contest of agent speed"
Railway characterizes the incident as a battle of automated tooling. The attackers deployed AI‑powered agents to probe many parallel routes across the infrastructure; Railway's defenders simultaneously hardened multiple potential attack paths. The company describes the escalation as a contest of agent speed, noting the attackers used "abliterated models and a harness similar to ARTEX," according to Wiz.
Railway's investigators say the attackers specifically searched for AI provider credentials, though some queries also targeted cloud, database, and payment service credentials. The company reports it has remediated the exploited vulnerabilities.
Connections to "Black October" and attacker motives
Railway links the incident to a recent wave of attacks that security firm Wiz has dubbed "Black October." According to the company, that campaign has targeted multiple AI development platforms during the past month, including Northflank, OpenCode, Warp, and Lightning AI. Railway says it believes the attackers were focused on stealing AI credentials for resale or for use in AI model distillation.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Railway warned customers to rotate secrets after detecting unauthorized access to systems storing environment variables. The parallel hardening described by Railway highlights the need to rapidly secure build infrastructure, trust relationships, and secret‑management systems when exploitation is underway.
- Affected enterprises and procurement leaders: Railway is coordinating refunds with AI providers and will cover charges providers decline to refund. Organizations that used Railway should verify secret rotation, confirm any linked tokens were reset, and review notifications sent to the 1,852 users whose tokens were exposed.
- End users and developers: Railway says it reset exposed linked‑account tokens and notified affected users; the company also reports no evidence of stolen Git repositories or accessed customer databases. Users whose accounts were tied to Railway workspaces should follow any Railway instructions and rotate credentials where advised.
Railway's account frames the breach as both a traditional exploitation of infrastructure weaknesses and an episode in a broader campaign aimed at harvesting AI credentials. The company has remediated the reported vulnerabilities, removed attackers from its systems, reset exposed tokens, and pledged financial remediation where vendor refunds are not forthcoming. How other platforms targeted in "Black October" respond—and whether the resale or model‑distillation markets that Railway cites absorb the stolen credentials—remains a consequential follow‑up to this incident.
