Platform-as-a-Service (PaaS) provider Railway on Wednesday disclosed "anomalous activity" related to systems that store customer environment variables.
Upon further investigation, the company found that an unauthorized third party may have gained access to encrypted environment variables, and, in some cases, obtained the decrypted contents. The impact, it said, is limited to a "subset of users," although it did not disclose an exact number.
Environment variables refer to user-defined key-value pairs that are used to store sensitive data like API keys, database credentials, or feature flags. They are configured at the operating system or container environment level instead of hard-coding the values directly into a program's source code.
Railway said the incident is likely part of a series of attacks designed to target platform companies with the ultimate goal of compromising artificial intelligence (AI) inference providers. The company also said it has notified upstream providers to proactively revoke the keys so as to prevent their abuse.
Customers are being urged to take the following actions as a precautionary measure -
- Rotate environment variables, including any API keys, stored in Railway, as well as private registry credentials.
- Review logs for those services for unusual activity
According to security researcher Taylor Monahan (@tayvano_), the incident has also allowed the attackers (0xd9773325282874d18cb83f1fe50f14c39750b2ee) to drain cryptocurrency wallets whose private keys were stored on Railway. The first known cryptocurrency theft transaction is said to have occurred at 7:36 p.m., at least two hours before the incident was officially disclosed.
Railway has since rotated all Railway bucket credentials and invalidated Railway API tokens in response to the incident. It has also restored builds for Pro and Enterprise workspaces, allowing customers to apply new credentials added in Railway.
"Builds remain available for Pro and Enterprise workspaces," it said. "We are continuing to work on enabling builds for Hobby, then Free and Trial. Some builds are still failing more often than usual, and many deployments remain queued with longer than usual wait times. We are continuing to work on both."
The development comes as threat actors are not only increasingly incorporating AI into various stages of the attack lifecycle, but also obtain unauthorized access to cloud victim environments to run Large Language Models (LLMs), leaving them to foot the bill. This approach is called LLMjacking.
In one case documented by Wiz earlier this week, threat actors compromised privileged Google Cloud Platform (GCP) credentials and linked external, attacker-controlled GCP projects to the victim's internal billing accounts.
The attack has been found to leverage sponsored ads on Google Search as an initial access vector, deceiving users searching for common terms like "google cloud" or "gap" to a fake Google login web page via a Google Sites redirect, harvesting their account credentials and multi-factor authentication (MFA) codes in the process.
Upon gaining access to the victim's GCP environment, the threat actor is said to have abused the compromised account’s excessive privileges to deepen their access, circumvent security controls, and add external actor-controlled Gmail accounts directly into the organization's billing account.
"Because the AI workloads were processed in foreign projects, prompt contents and model outputs remained completely hidden from the victim organization, leaving the nature of the mass AI usage unknown," Wiz researchers Shira Ayal and Andre Maccarone said.
These resource abuse cases are not isolated. According to the Symantec Threat Hunter Team, attackers are targeting exposed LLM endpoints to power an autonomous cybercrime operation capable of scanning the internet, exploiting vulnerabilities, stealing credentials, and mining cryptocurrency without human intervention for up to 100,000 steps.
The activity is powered by an offensive AI agent, which operates in a "Skynet mode" to scan and infect targets with miners and allow the threat actors to run their own attacks. The exploits target Microsoft Visual Studio Code, Django, Jupyter, Laravel, Supabase, Next.js, and Flask/Werkzeug deployments.
The end goal is free inference. Rather than simply using AI to generate malicious content, the malicious AI agent uses the hijacked AI models to plan and direct attacks, while shifting the compute cost to the legitimate owner and obscuring their own identity.
Put differently, the idea is to devise a malicious agent that can hijack a legitimate AI system and turn it into "a devoted companion that must never refuse" and an unwitting cybercrime tool.
"The captured instructions defined a single agent equipped for internet-wide scanning, exploitation of several common web frameworks, database theft, credential and secret harvesting, and cryptocurrency mining," the Symantec Threat Hunter Team said in a report shared with The Hacker News.
"The activity is a form of LLMjacking, where attackers steal access to someone else's AI model so that the victim pays for the computing power."
Dick O'Brien, principal intelligence analyst at the Symantec Threat Hunter Team, told The Hacker News that there is no evidence that the activity it observed and the Railway incident are linked, and that there is nothing in the honeypot data that points to such a connection.
"Having said that, the two share a common thread. API keys for AI models are valuable because anyone holding one can run inference at the owner's expense, and our honeypot recorded a lot of stolen-key spraying against model endpoints," O'Brien said. "Keys taken from a platform's stored environment variables could be used in the same way, although Railway hasn't said whether any have been abused."
Update
Railway has made available builds for Hobby, Free, and Trial workspaces, along with Pro and Enterprise versions. "New signups remain temporarily paused while we focus on existing customers," Railway said. "We are continuing to send notification emails to impacted customers."
Targeted for Distillation Attacks
In a new update, Railway said it became aware of a "sustained and targeted campaign" to breach its infrastructure on October 20, 2026, at 7:53 p.m. UTC with an aim to conduct distillation attacks.
"Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks," the company said. "Initial evidence leads us to believe that the malicious actor had access to abliterated models and substantial compute resources which enabled them to perform highly sophisticated exploits against our infrastructure."
The incident is assessed to have potentially compromised environment variables associated with "at most 1.85% of all workspaces," which translates to about 100,000 workspaces. Railway said it's reaching out to customers with a definite impact, and proactively contacting those who may be at "high risk."
Two categories of risk have been identified based on the fact that the attacker was likely seeking high value targets on the platform -
- Workspaces with a very large number of environment variables
- Environments with a high amount of AI keys from vendors
Railway also said it proactively worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke the potentially compromised keys upon learning they were accessed on October 21, 2026, at 9:25 a.m. UTC.
As a precautionary measure, all users are recommended to revoke and reapply sensitive environment variables stored on Railway prior to October 21, 2026. Railway is also advising all users to -
- Remove public network access to databases.
- Rotate any sensitive variables and keys.
- Check GitHub account audit logs and review all app access.
- Check audit logs within registries such as Docker Hub
"We continue to refine our platform and corporate security posture, taking all reasonable steps to mitigate attack vectors," it added. "We performed other mitigations that we are choosing to not disclose at this time out of an abundance of caution in protecting the safety of our customers."
