Railway stolen AI keys: $740K spend, and who refunds what

Railway's final incident report puts a number on the October breach: stolen AI API keys ran up an estimated ~$740,000 in unauthorized spend. The report also shows something every team with an AI key should read. Whether you get that money back depends on which AI provider issued the key, not on who lost it.

What actually happened

Railway published its incident report on November 10. We covered the breach in October. The new details:

• Timeline. The initial exploit was a partial escape from build filesystem isolation at 07:28 UTC on October 20. Railway says the attacker was fully evicted at 09:24 UTC on October 21. This corrects the preliminary report, which started the clock later.
• Scope. Environment variables for "at most, 1.85% (~100,000) of workspaces" were exposed. Railway calls that an upper bound. 1,852 users also had linked-account tokens exposed, and Railway reset them.
• Motive. Railway says the attacker hunted AI provider credentials to sell to "transfer stations" for model distillation. It points to Wiz's research on similar attacks against AI developer platforms but does not attribute this one.
• Refunds, provider by provider. AWS Bedrock and Google apply their fraud refund policies. OpenAI reviews claims case by case. Railway is paying Anthropic charges itself while it talks to Anthropic. OpenRouter is enforcing its no-refund terms, so Railway says it will cover those costs.

Railway says it will backstop losses that providers refuse. Customers report charges through a claim form linked in the report. The Hacker News notes that the report states no cap or deadline, and does not say how Railway estimated the $740,000.

Why it matters for your business

A leaked AI key is a blank check. Railway is unusual because it is paying. Your next host or vendor may not. And the refund lottery is real: the same stolen key gets you a refund from one provider and a "per our terms" from another.

So treat every AI key as a payment card:

1. Set hard spend limits per key. Use the provider's project or key-level budgets. A key that can only spend $50 a day can only lose $50 a day.
2. One key per app and environment. Then you can revoke one leak without taking down everything.
3. Read the refund terms before you top up prepaid credit. No-refund resellers are a risk you can price.
4. Alert on spend spikes. You want to know in hours, not at the end of the month.

Sources: Railway incident report, BleepingComputer, The Hacker News.