Black October / LLMjacking: Railway — hackers stole customer secrets, ran $740K in fraudulent AI usage
Severity: high · Patch status: no-fix-needed · Since 2026-10-22
Attackers exploited a previously unknown vulnerability in Railway's build infrastructure on 2026-10-20 to escape filesystem isolation and obtain an internal credential, then used it to access build histories and steal Railway's internal source code. A second flaw involving an improperly configured trust relationship yielded credentials to decrypt customer environment variables, potentially affecting up to 1.85% of workspaces (~100,000). Using AI-powered agents in a ~26-hour battle against defenders, the attackers targeted AI provider credentials and generated roughly $740,000 in unauthorized AI usage, part of Wiz's 'Black October' campaign against AI developer platforms (Northflank, OpenCode, Warp, Lightning AI). GitHub OAuth tokens and AI agent keys for 1,852 users were exposed and reset. Railway removed attackers on 2026-10-21, remediated all exploited vulnerabilities, will cover unreimbursed charges, and found no evidence of Git repository or database access.
What to do
- Rotate all secrets and environment variables stored in Railway workspaces immediately
- Revoke and re-issue GitHub OAuth tokens and AI provider API keys linked to Railway accounts
- Audit AI provider and cloud billing for unauthorized usage and dispute fraudulent charges
- Review Railway-linked CI/CD and agent integrations for signs of abuse
- Monitor AI provider accounts for anomalous model usage or distillation activity
Sources
All live incidents on Threat Watch
