Railway requires all customers to rotate keys after intrusion
Developer platform Railway is requiring all customers to rotate all keys after intruders decrypted some stored credentials. These environment variables include database passwords, cloud keys, and model API keys; holders could log in as the owner. Railway said only some users may be affected, but it froze all deployments itself and reset bucket keys and GitHub tokens, while linking this intrusion to a series of attacks targeting AI inference service platforms and asking the relevant providers to revoke keys. A few days earlier, OpenCode attributed a leak to a distillation attack, which may have exposed OpenAI, Anthropic, and Google keys saved by 1.4% of Console users.
Why read this
AI score 68
The incident links key leakage with distillation attacks, allowing readers to understand the path and scope of credential theft at AI inference platforms.
Topics
Body
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.
Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.
Railway said a subset of users may be affected, yet it froze all deployments and reset bucket keys and GitHub tokens itself.
It tied the intrusion to a string of attacks on platforms aimed at AI inference providers, and asked those providers to revoke keys.
Days earlier, OpenCode blamed a distillation attack for a breach possibly exposing OpenAI, Anthropic and Google keys saved by 1.4% of Console users.
Stolen keys let attackers harvest frontier-model answers for training rival models while victims pay the bills.