Cloud hosting provider Railway has disclosed a major cybersecurity breach in which hackers stole authentication credentials and generated approximately $740,000 in unauthorised artificial intelligence (AI) usage charges. The attack potentially exposed sensitive credentials associated with nearly 100,000 customer workspaces, raising concerns about the security of infrastructure used to develop and deploy AI applications.

The attackers reportedly exploited multiple vulnerabilities in Railway’s systems, using automated AI-powered agents to identify weaknesses and access sensitive information.

How Hackers Breached Railway’s Cloud Infrastructure

The cyberattack began on October 20, when hackers exploited a previously unknown vulnerability in Railway’s build infrastructure. The security flaw allowed them to escape filesystem isolation, a mechanism designed to keep different processes and environments separated. This enabled the attackers to obtain an internal credential and gain access to stored build histories and Railway’s internal source code.

The stolen source code was subsequently examined to identify additional weaknesses within the platform. Investigators found that the attackers exploited a second vulnerability involving an improperly configured trust relationship. This allowed them to access credentials used to decrypt customer environment variables, potentially exposing sensitive authentication information stored within customer workspaces.

The attackers effectively used their initial access to identify further security weaknesses, turning what began as a compromise of Railway’s build infrastructure into a wider breach involving internal systems and customer credentials.

Nearly 100,000 Workspaces Potentially Exposed In The Breach

Railway estimated that the breach potentially affected up to 1.85% of its customer workspaces, representing approximately 100,000 workspaces. However, the company clarified that this figure represents the maximum number of workspaces that could have been exposed and does not mean that credentials belonging to all these customers were necessarily stolen.

The investigation also identified compromised linked-account authentication tokens belonging to 1,852 users. These included GitHub OAuth tokens and keys used by AI agents to access external services. Following the discovery, Railway reset the affected tokens and began notifying customers whose credentials were involved in the incident.

The distinction between potential exposure and confirmed credential compromise is significant, as the breach involved a much larger pool of potentially affected workspaces than the number of users whose linked-account tokens were identified as compromised.

How Hackers Used AI Agents To Exploit Railway’s Security Weaknesses

The attackers reportedly deployed AI-powered agents to identify and exploit vulnerabilities across Railway’s infrastructure. Rather than relying on a single entry point, they used automated tools to examine multiple possible attack routes simultaneously, allowing them to probe the platform for additional weaknesses.

The intrusion developed into an approximately 26-hour confrontation between the attackers and Railway’s security engineers. While the hackers continued exploring potential vulnerabilities, Railway’s team worked to identify the intrusion, close security gaps and prevent further unauthorised access.

The company described the incident as a sustained struggle involving multiple attack routes rather than a conventional breach that could be contained through a single security fix. The use of automated AI agents also demonstrated how such tools can accelerate vulnerability discovery and allow attackers to examine complex cloud infrastructure at scale.

How Stolen AI Credentials Generated $740,000 In Unauthorised Charges

Investigators discovered that the attackers specifically searched Railway’s systems for authentication credentials belonging to artificial intelligence service providers. Their searches also extended to credentials associated with cloud infrastructure, databases and payment services, suggesting an attempt to obtain access to multiple third-party platforms through the compromised environment.

The stolen AI credentials were subsequently used to generate approximately $740,000 in unauthorised usage charges. Such credentials can provide access to AI services and computing resources, allowing anyone possessing them to run workloads and consume services under another user’s or organisation’s account.

Railway said it was working with the affected service providers to secure reimbursements for the fraudulent charges. The company also committed to covering any amounts that providers declined to refund. According to Railway, the attackers may have intended to resell the stolen AI credentials or use them for AI model distillation, a process through which one AI model is trained using the outputs of another.

Did The Railway Breach Expose Customer Data?

Despite the compromise of its internal infrastructure, Railway said its investigation had found no evidence that attackers downloaded customer Git repositories or accessed customer databases. However, the exposure of credentials used to decrypt customer environment variables meant that sensitive authentication information could potentially have been accessed.

The company confirmed that the attackers had been completely removed from its systems on October 21 and that the vulnerabilities exploited during the incident had been remediated. Railway had initially disclosed the security incident on October 22, advising customers to rotate their secrets as a precaution against further unauthorised access.

The company also reset affected authentication tokens and notified users whose linked credentials had been compromised. While Railway reported no evidence of customer database theft, the incident highlighted how a breach of development infrastructure can create security risks extending beyond the platform itself to the external services connected to customer accounts.

Black October And The Growing Cybersecurity Threat To AI Development Platforms

The Railway breach is reportedly part of a broader campaign targeting companies that provide infrastructure and tools for artificial intelligence development. Security researchers have identified the campaign as Black October, which involved attempts to steal authentication credentials and exploit vulnerabilities in platforms supporting AI applications.

Other platforms reportedly targeted during the same period include Northflank, OpenCode, Warp and Lightning AI.

The attacks point to growing security risks for companies providing cloud hosting, AI development environments and services that allow developers to build and deploy AI-powered applications.

The Railway incident also spotlights how cybercriminals can inflict substantial financial damage without necessarily accessing customer databases or downloading proprietary source code. Stolen AI service credentials can be used to consume expensive computing resources, generate fraudulent bills or potentially be resold to other users.

The use of automated AI agents in the attack adds another dimension to the threat, demonstrating how emerging technologies can be deployed not only to build applications but also to identify vulnerabilities and accelerate cyberattacks against the very infrastructure supporting them.