Railway will cover AI charges on keys stolen in its breach. Claim by November 18

What Railway changed this week

Railway now says it will pay for AI usage on keys stolen from it when the provider won’t. Its incident report of November 10 promised to backstop the losses “from our own balances for those unwilling to do so,” and a bulletin dated November 12, 2026 sets out the policy and how to claim: “we will attempt to help you get compensated by the AI provider for unauthorized usage on a key exposed in this incident, and if the AI provider will not refund, we will pay for it.” It puts customers’ losses at “at least ~$740K in AI tokens.”

Until this week the answer was no. Railway’s preliminary report still says it “is unable to refund customers for spend performed with compromised API keys,” and a customer on Railway’s forum wrote in late October that support had declined a $137.26 credit, quoting a decision that “reflects our policy for this incident.”

What the bulletin covers: “Unauthorized usage on any AI provider key stored in Railway and compromised from 13:50 UTC on 10/20 until the attacker was expelled on 10/21 at 9:25 UTC. This applies to every provider, including ones not listed below.” That window is when a key was taken; the bulletin gives no end date for the spending. It covers AI provider keys only, and doesn’t mention other stolen credentials, such as the Twilio charges and cryptocurrency losses customers have reported.

How to claim

1. Fill in Railway’s claim form. You’ll need the provider, the date range, and an invoice or usage report.
2. If the provider has its own refund process, start that too. Railway names OpenAI, AWS Bedrock and Google Gemini, and asks you to add the provider’s case ID to your claim.
3. File by Wednesday, November 18, 2026. Railway says “we will do our best to honor claims submitted after that,” and aims to “review all claims with[in] 15 business days.”

Here is what the bulletin says about each provider:

Provider	Its policy, per Railway	What you do
AWS Bedrock	“AWS refunds under its fraud policy”	Contact AWS support, then claim
Google Gemini	“Google refunds under its fraud policy”	Contact Google support, then claim
OpenAI	“Reviewed case by case with us”	Open an OpenAI support case and send Railway the case ID
OpenRouter	“OpenRouter refunds under goodwill agreement”	Claim through Railway
SpaceXSI	“Reviewed case by case with us”	Claim through Railway
Anthropic	“Railway covers costs while we finalize the process”	Claim through Railway
Anyone else	“Railway covers unrefunded spend”	Claim through Railway

OpenRouter’s line moved within two days. Railway’s November 10 report said OpenRouter “has decided to enforce their no-refund policy as per their Terms of Service,” and that Railway would cover those costs itself. Railway is paying claims “from Railway’s own funds now” while it seeks insurance reimbursement, and says it will update the bulletin “as provider policies change.” It doesn’t say whether customers it turned down before need to file again; if that’s you, file the form.

What Railway’s final report says

Railway published its incident report on November 10. The main findings:

• How they got in. The attacker “exploited a previously unknown vulnerability in our build infrastructure” at 07:28 UTC on October 20, then, at 03:26 UTC on October 21, used “an erroneously defined OIDC binding configuration in one of our cloud environments” to reach the credentials that decrypt customer variables. The attacker’s first signups were on October 18.
• What they took. Variables from “at most 1.85% of workspaces, about 100,000,” an upper bound because the logs “identify a subset of environments, not individual variables.” Also “linked-account tokens (BYOK agent keys and GitHub OAuth tokens) for 1,852 users,” which Railway reset, and the stored histories of 353 builds, “sealed variables included.”
• What they didn’t. “We have no indication that the attacker downloaded snapshots or repositories of Railway customers,” and “forensics did not indicate customer databases were accessed.” The attacker did copy Railway’s own monorepo, and used it to find the second way in.
• What they wanted. “The attacker was specifically targeting AI provider credentials,” with database queries matching AI key names, and Railway believes the keys went to resellers “for use in distillation.” The stolen keys’ use since “ranges from coding agents to AI training pipelines.”

Signups, paused on October 22, reopened on November 2. Railway has filed a complaint with the FBI’s IC3 and says a forensics firm’s investigation is ongoing.

The platforms hit

Railway was one of “at least nine” AI developer platforms that Wiz counted on October 30. “All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access,” it said. Environment variables are the settings a hosted app reads when it runs; in Railway’s words, they “may contain secrets such as API keys or database and registry credentials.”

The dates are the ones Wiz gives. The rest comes from each platform’s own notice.

Platform	Date	What it says was reached	Who needs to act
Fireworks AI	Oct 6	Environment variables, “including API keys and tokens stored as secrets,” in a limited number of accounts	Customers it emailed
Andromeda	Oct 9	“Certain Andromeda and customer credentials” in a limited number of accounts	Customers it contacted
Zeabur	Oct 14	3,218,965 environment variable records, and the details of 321,810 accounts	Everyone: “Replace every password and key stored on Zeabur”
Lightning AI	Oct 15	“Certain customer credentials”	Everyone, whether contacted or not
OpenCode Console	Oct 16–17	Provider keys saved by 1.4% of Console users	Users it emailed
Railway	Oct 20	Variables in at most 1.85% of workspaces, about 100,000, and linked-account tokens for 1,852 users	Everyone with variables stored before October 21
Warp	Oct 23	“A limited amount of agent trace and telemetry data,” with an upper bound of roughly 1% of users	Users it notified
Command Code	Oct 28	“No evidence that any users were impacted,” but it revoked all API keys	Everyone needs a new Command Code key from Studio
Northflank	Oct 30	Secrets held in its control plane, with the first known decryption between 02:39 and 03:08 UTC that day	Everyone

Northflank told customers on October 30 to “Assume all environment variables have been decrypted,” and within hours that “multiple users are confirming that their AI keys have been used.” Its November 6 update says it has “found no evidence that customer workloads or workload data were accessed,” and that “The exploit was patched within 60 minutes of notification.” It asks users to rotate all secrets and “enable IP restrictions and budget limits wherever available,” and its status page still lists the incident, under Monitoring.

Wiz has kept adding to its list since. Its updates name Brev (NVIDIA), Trigger.dev, Chainstack, Kernel, Blacksmith, Tensorlake and NEAR AI, plus social media reports about RunPod, without saying they share a cause. Here are the four whose notices we read:

Platform	Dates	What it says was reached	Who needs to act
Trigger.dev	Nov 1	Environment variables for “a subset of organizations”	Account owners it emailed
Chainstack	Oct 26–31	Account details, including names, emails and password hashes; node credentials treated as exposed	Every customer: new passwords, node credentials and platform API keys
Kernel	Oct 24–Nov 3	“A small number of kernel API keys and app deployments’ third-party secrets,” for 0.28% of customers	Organizations it notified
NEAR AI	Nov 8	Account details of about 100 users and 18 agents on a legacy deployment, through a flaw in the SGLang inference engine	Users it contacted

Fireworks has updated its bulletin too: intruders also reached account and billing details and, for some customers, datasets and incomplete model weights, and Notion AI chats were among the data. The Fireworks memo has the details. Zeabur users have a second job, because it shuts down on December 31. Its report calls that “an operational decision,” while its founder says the company reassessed after this attack.

What happens to a stolen key

Wiz followed two enterprise Amazon Bedrock keys that it ties to one of these breaches, without saying which. Each got a test call “within 30 minutes” of the reported theft. Then both went nearly quiet, at 14 to 120 calls a day, while something checked that they still worked. Then came the flood:

	Case A	Case B
Nearly quiet for	About four days	About a week
Calls in the flood	About 800,000 in 30 hours	About 1.7 million in 13 hours
Calls that succeeded	About 90%	Over a million
Most-used models	Opus 5, Opus 5.5, Opus 4.8	Opus 5.5, Sonnet 4.5, Opus 5

“At list price, these two cases alone likely ran up over $100k in usage,” Wiz estimates. That’s a list-price estimate, not a billed total. The practical lesson is the gap before the flood: an account that looks normal today doesn’t clear a key. Fireworks says the same in its notice: rotate “even if you do not find suspicious activity.”

Wiz calls this LLMjacking, stealing access to AI models and spending it on someone else’s bill, and says the traffic “resembles resold coding-agent traffic.” Railway’s customers saw the same: the requests they shared included “coding-agent requests, reviews of AI-agent behavior for use as training data, and checks of training tasks and their scoring systems,” which Railway calls “consistent with compromised credentials being distributed through services that relay or resell access to AI providers.”

Smaller accounts got hurt too. Customers on Railway’s forum describe a Gemini key running up €133 against an expected €0.02, and about $1,200 in Twilio calls. Wiz cites an alleged theft of about $371,000 in cryptocurrency using keys stored in Railway, reported on X by a user named Tay, and calls such reports anecdotal.

What to do now

1. List every hosted service that holds your keys. Start with the tables, then add the deploy platforms, notebooks, CI systems and agent tools they don’t name. If you never stored anything on these platforms, none of these notices asks anything of you.
2. Revoke each key where it was issued. “Removing a stored secret alone does not invalidate the underlying credential,” as Fireworks puts it. A copied key keeps working until its issuer kills it. The steps are in the next table.
3. Replace everything else stored there too. Database passwords, GitHub tokens, registry logins, and payment and messaging keys. Northflank has turned on rotation for its Postgres, MongoDB, MySQL, Redis, MinIO and RabbitMQ add-ons. Zeabur lists further steps, including for n8n and for databases on its shared clusters.
4. Update the variables and redeploy, so your services stop using the old values.
5. Turn off public access to databases. Railway and Northflank both advise it.
6. Check your logs and bills back to the date in the table. That means each provider’s usage page, your GitHub audit log and installed apps, and your registry’s logs. Northflank has turned on audit logs for all customers, free ones included. Zeabur says to review bills from October 14, or September 1 if you had a GCP Dedicated Server. Keep what you find, since every refund asks for it.
7. If the key was on Railway, claim by November 18, as above.
8. Give each service its own key and a ceiling. OpenAI offers hard limits, though “enforcement is not instantaneous.” Google suggests billing alerts.

Who issued the key	How to replace it
Anthropic	On the Claude Console’s API keys page, open the menu beside the key and choose “Delete API key,” then “Create key.” Contact support about suspicious activity
OpenAI	Delete the key in the API key dashboard, review your usage and keep the details, then contact support
Google Gemini	Create a new key, deploy it, disable the old one in the Cloud console, then check billing logs and API usage
AWS	Create a new access key, deactivate the old one, confirm your app works, then delete the old one

Google’s and AWS’s order keeps your app running. If someone is already spending on the key, kill it first and accept the downtime.

If a provider revoked your key

You may get an email from a provider before you’ve done anything. Railway asked GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google and Stripe to revoke keys and, as it couldn’t yet tell which were exposed, “provided hashes of every key we held.” “Users being notified by vendors about revocation does not imply that their credentials were impacted by the incident,” it says.

Some people then had their replacement keys revoked as well. On October 23, providers asked for another batch. Railway says it sent one to OpenAI and Anthropic, “but because we could not filter keys by when they were added, it inadvertently included newer keys.” It adds: “These revocations do not indicate that your replacement keys were compromised.”

The fix is the same either way: create a replacement, update the variable, redeploy. If your replacement keys still work, Railway says you don’t need to rotate them again. A key you never replaced still needs replacing.

Getting money back elsewhere

Railway is the only platform here that has published a promise to pay what providers won’t. Zeabur takes compensation requests. For the rest, start with the provider that billed you, and bring evidence. We didn’t find a provider refund policy covering this wave as a whole.

Who	What’s been said
Zeabur	Request compensation through a support ticket. It will check the provider’s records
Northflank	“If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic.” It hasn’t mentioned refunds
OpenAI	For OpenCode, Thibault Sottiaux said affected API customers would have “any credits refunded which would have been drawn in the attack”
Google	Railway says Google “refunds under its fraud policy.” On Railway’s forum, one customer says Google declined a refund and another that it credited part of the charge
Twilio	A customer on the same thread says Twilio gave credits rather than a refund, and that evidence of what happened mattered most

The notices from Fireworks, Andromeda, Lightning, Warp, Command Code and the newer four don’t mention charges. The OpenCode memo has what OpenCode, Anthropic and Google said about theirs.

What nobody has said

• Who did it. Wiz finds “no single vulnerability or dependency linking these attacks.” Several attackers used the same kind of tool, though: Chainstack and Kernel each say theirs used ARTEX, which Chainstack describes as “an open-source framework that orchestrates LLM agents to automate intrusions,” and Railway says it faced “a harness similar to ARTEX, according to Wiz.” Kernel calls its attacker “financially motivated” and part of “a larger cryptomining campaign.” None names a group.
• Why. Railway, OpenCode and Command Code call it distillation, collecting a model’s answers in bulk to train another. Wiz agrees distillation drives demand, but what it measured looks like resale. Railway says it hasn’t established whether its attacker ran those resale services or “supplied credentials to other parties.”
• How Northflank was reached. It says the exploit was patched within an hour and, separately, that it has patched CVE-2026-98432 across its fleet, but it hasn’t said how attackers got in or how many customers were affected. It will share “a root cause analysis once available.”
• What was in Warp’s traces. The company didn’t clarify whether they included source code, prompts or credentials, BleepingComputer reports.
• Which of your Railway keys were taken. Railway’s logs can’t say. Its claim form asks you to show the spending instead.
• The final count. Wiz’s list has grown from nine platforms to 16 since October 30. LiteLLM’s compromise that month isn’t on it, and no one has shown it’s connected.

Keeping less at risk

A key you never hand to a hosted service can’t leak from one. The apps you deploy still need their secrets somewhere, so give each its own, as narrow as it can be. Restrictions helped, if only partly, in Wiz’s cases: Case B’s key was limited to one set of Bedrock routes, so a reseller’s first attempts failed and more of the flood was throttled, while Case A’s broader key saw only about 6% throttled. Northflank now asks providers for “enforceable budget limits” for the same reason.

Writing code doesn’t need a key on anyone’s server. Claude Code and Codex sign in with your plan, OpenCode keeps the keys you add on your computer, and a local model needs no key at all. Enjoy runs these agents on your computer, each signed in with your own account on the plan you already pay for. That covers the agents, not your deployed apps, whose secrets still live wherever you host them. For secrets in your own projects, see Keep passwords and API keys safe.

We’ll update this memo when Railway’s claim process or a provider’s policy changes, or when Northflank publishes its root cause.