Railway breach leads to $740,000 in fraudulent AI charges

🚨 Railway says stolen customer AI keys led to an estimated $740,000 in unauthorized charges. Attackers exploited a build isolation flaw, moved through internal cloud systems, and decrypted customer secrets. Railway will cover charges AI providers won't refun

TL;DR: An attacker escaped Railway’s build isolation, stole its source code, and used misconfigured access to go shopping for customer AI keys. Up to ~100,000 workspaces potentially affected and ~$740,000 in unauthorized usage later, “bring your own key” beca