Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, cloud hosting provider Railway suffered a sophisticated two-stage breach that exposed decrypted environment variables for up to 100,000 customer workspaces and resulted in approximately $740,000 in fraudulent AI usage charges. Beginning on October 20, attackers exploited an unknown vulnerability in Railway's build infrastructure to escape filesystem isolation, obtain an internal credential, and exfiltrate a copy of the platform's source code. A second vulnerability involving a misconfigured trust relationship then allowed adversaries to retrieve customer credential decryption keys. Using AI-powered agents, attackers specifically targeted AI provider API keys and orchestrated a 26-hour adversarial contest against Railway's engineering team before being fully evicted on October 21.

This incident is part of a broader campaign dubbed 'Black October' by Wiz, targeting AI developer platforms including Northflank, OpenCode, Warp, and Lightning AI. It underscores how AI credential theft — or LLMjacking — has evolved into a scalable, financially motivated attack class where stolen API keys are monetized through model distillation or resale, exposing cloud-native organizations to both direct financial liability and downstream supply-chain risk.

Why This Matters Now

LLMjacking attacks are accelerating in 2026 as AI API keys become high-value targets rivaling financial credentials. The 'Black October' campaign demonstrates that build pipeline vulnerabilities and misconfigured trust relationships in cloud-native platforms can be chained rapidly by AI-augmented threat actors, outpacing traditional detection and response timelines and generating six-figure fraudulent charges within hours.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers exploited two chained vulnerabilities in Railway's build infrastructure to obtain decrypted customer environment variables containing AI provider API keys. These stolen credentials were then used to run unauthorized AI workloads — a technique known as LLMjacking — likely for model distillation or resale on underground markets.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because the attacker's success depended on unrestricted internal reachability across Railway's build infrastructure, secrets stores, and customer environment data. Enforced workload segmentation and identity-aware access boundaries would likely have constrained the blast radius across the 26-hour adversarial campaign, limiting lateral reach and reducing the scope of credential exposure.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: A compromised build workload would likely find its internal reachability constrained, reducing its ability to communicate freely with adjacent infrastructure components beyond its defined role.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain the ability of a low-privilege internal credential to reach secrets infrastructure or trust-bearing services beyond its defined access scope.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely reduce the number of internal paths available for AI-driven agents to traverse, narrowing the pivot surface across Railway's infrastructure components.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility controls could surface anomalous internal traffic patterns generated by autonomous agent activity, potentially reducing the window during which multi-route probing went undetected across Railway's environment.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Controlled egress policy enforcement would likely reduce the ability of internal workloads to transmit large volumes of extracted credentials or make unauthorized outbound connections to external AI provider endpoints.

Impact (Mitigations)

Had earlier segmentation and egress constraints reduced lateral reach and outbound credential exfiltration paths, the scope of exposed workspaces and operationalized credentials would likely have been smaller, limiting the financial and supply chain impact to a reduced subset of Railway's customer base.

Impact at a Glance

Affected Business Functions

  • Cloud Application Hosting and Deployment Pipelines
  • Customer Secrets and Environment Variable Management
  • AI Provider Integration and API Credential Storage
  • Developer OAuth and Third-Party Linked Account Services
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: $740,000

Data Exposure

Decrypted customer environment variables for up to approximately 100,000 workspaces were accessed, potentially exposing AI provider API keys, cloud service credentials, database connection strings, and payment service secrets. Linked-account tokens for 1,852 users were confirmed stolen, including GitHub OAuth tokens and AI agent keys. Stolen AI credentials were actively used to generate approximately $740,000 in unauthorized AI inference charges across affected AI providers. Additionally, Railway's internal source code was exfiltrated, potentially exposing proprietary platform logic and additional attack surface details.

Recommended Actions

  • • Apply Zero Trust Segmentation (microsegmentation and namespace-level identity-based policy) to build infrastructure so that a compromised build environment cannot access secrets stores or internal source code repositories — containing the blast radius of filesystem escape exploits before privilege escalation occurs.
  • • Deploy Multicloud Visibility and anomaly detection controls to establish behavioral baselines for internal API and secrets access patterns, enabling detection of AI-agent-driven parallel probing across infrastructure routes in near real time.
  • • Enforce Egress Security and Policy Enforcement with FQDN-based outbound filtering and egress firewall rules to block unauthorized outbound connections to AI provider endpoints from compromised workloads, preventing stolen credentials from being immediately weaponized for fraudulent usage.
  • • Implement East-West Traffic Security controls to restrict workload-to-workload and service-to-service communication within build and secrets management infrastructure, preventing lateral pivoting from an initially compromised build component to credential decryption services.
  • • Leverage Cloud Native Security Fabric (CNSF) with inline enforcement and real-time inspection across the control plane to detect agentic AI tooling behavior, shadow AI usage patterns, and autonomous multi-route exploitation attempts characteristic of ARTEX-style attack harnesses before exfiltration completes.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image