Railway breach: a $740K AI bill. Your API key is a credit card

You know the pattern. Someone in marketing builds a small workflow over a weekend: product copy via API, an agent that enriches leads, a script for social posts. It works great. The API key sits in an environment variable at some hosting provider and nobody thinks about it again. Those keys were the target.

What happened

• The attack: Starting October 20, 2026, attackers exploited a flaw in Railway's build infrastructure, BleepingComputer reports, got hold of internal credentials and source code, and later reached credentials that decrypt customer environment variables. Railway says they were out by October 21, and on October 22 it told all customers to rotate their secrets.
• The scale: Variables were decrypted in at most 1.85% of workspaces, roughly 100,000. Railway calls that a ceiling, not a confirmed count.
• The target: The attackers specifically searched for AI provider credentials, then burned about $740,000 in unauthorized AI usage. The report doesn't name the providers.
• The fallout: Railway is working with the AI providers on refunds and will cover whatever they decline. Tokens for 1,852 users, including GitHub OAuth tokens and AI agent keys, were reset.

AI keys are the new loot

Attackers used to want customer data or card numbers. This time they wanted compute. Railway suspects resale or model distillation, meaning harvesting outputs to train other models. And it's not a one-off: security firm Wiz ties the incident to a campaign it calls "Black October" that also hit other developer platforms.

Translation: an AI key today is a credit card with no limit, stored in a text file. Most marketing teams never wrote a spending policy for it, because it was "just a test".

The catch isn't Railway. It's the foundation

Sure, a host got breached. But to me the case shows something bigger: AI doesn't fix broken ways of working, it widens the cracks. If you build AI workflows without knowing which key lives where, who owns it and what it's allowed to cost, you don't have a tool problem. You have a process problem that just sent an invoice.

I build my own site, funnels and campaigns with Claude, which is exactly why the boring work comes with it: keys don't live in Dropbox, they live in a password manager or protected config. That's not expert security advice. It's hygiene any team can set for itself.

What I'd do now

• → Inventory: list every AI key your team has. Who created it, where does it live, which project uses it? Anything without an owner gets deleted.
• → Set caps: in your AI providers' consoles, set spending limits and alerts per project where the provider offers them. A $50 cap hurts nobody. $740,000 does.
• → If you're on Railway: follow the guidance in Railway's incident report, revoke and reissue keys at the AI provider, then check usage per key.

Bottom line: Every AI key without an owner and without a cap is an open tab someone else is running up right now.