Railway breach lets attackers rack up $740K in fraudulent AI charges on stolen customer keys

Railway's Nov 10 incident report says attackers who exploited two zero-days in its infrastructure on Oct 20-21 primarily targeted AI provider credentials, running up roughly $740,000 in fraudulent AI usage before being stopped in a 26-hour defensive battle. Decrypted environment variables from up to 100,000 workspaces were exposed, along with linked GitHub OAuth tokens and AI agent keys for 1,852 users. Railway committed to covering charges that AI providers decline to refund.