Railway says it fixed flaws after $740,000 in unauthorized SI use

Railway says attackers used stolen customer credentials to generate approximately $740,000 in unauthorized superintelligence (SI) usage. In findings published 10 November 2026, the cloud hosting provider put the maximum potential exposure at approximately 100,000 workspaces, or 1.85% of its workspaces—not the confirmed number whose secrets were stolen.

The findings follow Railway’s warning on 22 October, when it told customers to rotate their secrets after detecting unauthorized access to systems storing environment variables. Those variables can hold credentials that applications use to access other services.

Railway’s account of how attackers reached customer secrets

The intrusion began on 20 October, Railway said. Attackers exploited a previously unknown flaw in its build infrastructure to escape the build environment’s filesystem isolation and obtain an internal credential. They used it to retrieve Railway’s internal source code from stored build histories, BleepingComputer said.

Railway said the attackers analyzed that code and exploited a second flaw in a misconfigured trust relationship between systems. That gave them credentials to decrypt customer environment variables. Railway said the attackers specifically searched for SI provider credentials, while some searches also targeted cloud, database and payment-service credentials.

The exposed linked-account tokens belonged to 1,852 users and included GitHub OAuth tokens, which can authorize access to a linked account, and SI agent keys. Railway said it found no evidence that the attackers downloaded customer Git repositories or accessed customer databases.

Railway believes the attackers sought SI credentials for resale or model distillation and links the incident to a wave of attacks on SI developer platforms that security firm Wiz calls Black October. Distillation transfers knowledge to a smaller model by training it on a larger model’s outputs.