Railway, a cloud platform that hosts applications for more than two million developers, told customers on October 21 that an unauthorised third party may have accessed the encrypted environment variables where their apps keep their secrets — and, for some of them, obtained the decrypted contents.
Environment variables are where an application keeps the keys to everything it touches: database passwords, payment processor credentials, container registry tokens, and increasingly the API keys that let it call frontier models. Railway said they were encrypted. The distinction between encrypted and safe turned out to be the whole incident.
The company believes the intrusion is "part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers," and has asked those providers to revoke affected keys.
What happened, in sequence
Railway detected anomalous activity on the morning of October 21. Problems on its status page began around 07:24 UTC. By that evening it had published a disclosure, at roughly 20:44 UTC, and paused all deployments in every region, including EU West. The dashboard, API and command-line tool were down or degraded for hours. It rotated its own storage bucket credentials and signed some users out; on October 22 it invalidated all Railway API tokens.
The pause created a trap. Rotating an exposed secret requires a redeployment. Deployments were blocked. Applications were left either running on credentials that may already have been stolen, or fully down. Railway eventually published thirteen recovery guides.
The theft was already underway
The damage preceded the disclosure. Blockchain researcher Taylor Monahan traced roughly $371,000 drained from Railway customers' wallets across nineteen EVM chains, with the first theft transaction occurring more than two hours before Railway went public. On-chain analysts separately flagged that Swell DAO's swETH and rswETH admin keys may have been compromised in connection with the breach, with attackers deploying four malicious upgrade contracts capable of siphoning approximately 2,500 ETH. A suspected attacker transferred $369,300 to HitBTC on October 22.
The AI-side losses were reported by developers in real time. Nevo David, founder of the social scheduling service Postiz, said he was shutting the product down for all customers after receiving emails from Anthropic and Stripe that his company's keys had been compromised. One Postiz engineer reported that AWS had already blocked more than 3,000 requests made with stolen Claude credentials by the time the company found out.
Why AI keys specifically
A stolen AI API key is a credit card for compute, and it has three uses. The owner can be billed for expensive inference — "LLMjacking," in the researchers' term. The key can be resold as cheap access. Or it can be used for distillation: querying a frontier model at volume to train a cheaper copy.
Railway is not an isolated event. Fireworks AI disclosed a breach on October 9 involving customer environment variables in AI evaluation jobs. OpenCode Console was breached on the night of October 16 into 17, exposing OpenAI, Anthropic and Google API keys for approximately 1.4 percent of its console users, with victims reporting individual losses in the hundreds to thousands of dollars; OpenCode described it as a large-scale distillation attack without fully explaining the connection. And on the same day as Railway, LiteLLM — an open-source proxy many teams use to route calls across providers — had a poisoned version, 1.107.0, published to PyPI and Docker with a credential stealer inside. It was live for about two hours.
That is at least fourteen significant platform security incidents in October, by one count.
The structural problem
The pattern across all of them is the same, and it is not a failure of any single company's engineering. Agentic software concentrates credentials. A modern application may hold keys for three model providers, a vector database, an observability service, a payment processor and a cloud account, all in one place because that is where the deployment pipeline needs them. A platform that holds those for thousands of applications is a single point of extraction worth far more than any one customer's account.
The defensive advice is the same everywhere and mostly unmet: rotate every secret stored on the platform; check provider dashboards and logs for usage spikes at or before the rotation time; issue one key per application rather than one key per organisation; cap spend per key; and treat GCP service account keys as permanently compromised until manually disabled, because they do not expire by default.
What is not yet known
Railway has not said how many accounts were affected, describing the impact as possibly limited to a subset. A law firm investigating the incident cited figures hinting at around 252,000 users and 208,000 API keys; those numbers have not been confirmed by anyone.
The larger unanswered question is why this cluster of attacks is happening now. The plausible reading is economic: agentic coding has put more spendable credentials in more repositories and hosting platforms than at any previous point, and the value of a single stolen key has risen from a curiosity to a four-figure monthly bill. That makes platform companies — not model providers — the cheapest route to frontier compute on the market.