Railway breach: attacker used abliterated AI models + ARTEX-like harness to steal customer AI provider credentials (~$740K in fraudulent LLM usage)

On Oct 20-21, 2026 a threat actor breached Railway's build infrastructure by escaping filesystem isolation, then leveraged a compromised build credential against the self-hosted Temporal cluster to read stored build variables (environment variables, secrets, repos). After gaining the internal monorepo and a privileged understanding of the platform, the actor used agentic AI (abliterated models and a harness similar to ARTEX, per Wiz) to fan out, find further exploits, move laterally, and decrypt a subset of customer variables. Railway's final incident report, published/updated Nov 10, confirms the actor was specifically targeting AI provider credentials for resale/distillation and that unauthorized AI API usage reached ~$740,000. Railway was fully evicted by 09:24 UTC Oct 21.

This is a confirmed, in-the-wild AI-agent-driven attack on cloud infrastructure: the attacker did not just use AI as a code assistant, they ran an autonomous agentic harness to chain exploits and harvest secrets at machine speed, and the target was explicitly AI/LLM provider API credentials. It demonstrates the 'attacker uses AI agents to breach AI-credential-holding platforms' campaign class, where the stolen keys monetize directly as fraudulent LLM usage, and any organization storing LLM keys in a compute/build platform is exposed.

Attacker escaped build filesystem isolation via a previously unknown build-infrastructure flaw, stole a build credential, abused it to query the internal Temporal instance, extracted other builds' environment variables/secrets, read the internal monorepo to gain a privileged blueprint, then ran AI-agent fanouts (abliterated frontier models with an ARTEX-like harness) to discover and chain further exploits and decrypt customer secrets. The AI provider credentials were sold for use in model distillation, generating ~$740,000 in unauthorized AI API charges.

Railway build infrastructure (multi-tenant build isolation, self-hosted Temporal cluster) and all customer workspaces whose environment variables/secrets were stored in build variables; no product version — platform incident.

No software patch — operational response. Railway halted builds twice, rotated internal credentials, invalidated every user session/token on Oct 21, and hardened build isolation/Temporal trust. Customers should rotate any AI provider API keys, credentials, and secrets that may have been stored in Railway build variables, review AI-usage dashboards for anomalous spend, and monitor CloudTrail/audit logs.