Railway and Fireworks: AI API keys are the new target

What happened at Railway

On November 10, Railway published its full report on the October 20-21 attack (Railway). The attacker used a previously unknown vulnerability in the build infrastructure to partially escape filesystem isolation and grab a build credential. With it, they read other builds' histories, including variables, from an internal Temporal cluster and eventually obtained a copy of the internal monorepo.

In the code they found a misconfigured OIDC binding in a cloud environment. That gave them short-lived cloud credentials and then access to an orchestration machine holding a longer-lived credential able to decrypt encrypted variables. Database logs show they filtered variable names with regular expressions to target AI provider keys.

• At most 1.85% of workspaces, about 100,000, could have been affected (an upper bound).
• Linked-account tokens (BYOK agent keys, GitHub OAuth) for 1,852 users were decryptable; all were reset.
• Estimated unauthorized spend on stolen keys: about $740,000.
• Railway says the attacker used abliterated models with no safeguards and a harness similar to ARTEX, according to Wiz.

Railway believes the keys were passed to so-called transfer stations for use in distillation. Stolen keys were used for coding-agent requests, reviews of agent behavior and checks of training tasks. The report notes that OpenCode, Warp and Fireworks disclosed similar thefts between October 6 and 23.

And at Fireworks

Fireworks updated its October incident bulletin on November 9 (Fireworks AI). Its first notice covered only stored secrets. Since then it found that a third-party cloud provider hosting its R&D machines was breached on October 23, and the next day the attacker used that foothold to reach Fireworks development machines.

• Resource metadata: identifiers, names, descriptions.
• Billing data: addresses, invoice history, balances, credit usage. Card numbers are not stored.
• For certain customers, a subset of incomplete model weights and datasets.

Fireworks links the activity to a financially motivated LLMjacking group that sells unauthorized LLM access through illicit routing gateways. It has disabled self-serve dataset uploads and downloads for Batch Inference and dataset-based training. Inference, the Training SDK and Nexus are zero data retention by default and showed no impact. CEO Lin Qiao told The Register the attackers were not after weights and most downloads were partial and stopped (The Register).

What to check now

Both cases point the same way: AI API keys stored on platforms are now a standalone, easily monetized target. A few practical steps follow from the reports:

• If you use Railway or Fireworks, rotate the AI keys stored there and review provider bills for unusual usage.
• Set spend limits and alerts on every AI provider key.
• Use separate, narrowly scoped keys per environment instead of one shared all-powerful key.
• Where possible, use short-lived, just-in-time credentials instead of static keys.

Our earlier piece on ARTEX showed how an AI agent can move from leaked secrets to a cloud key vault (ARTEX: AI agents go from GitHub secrets to Key Vault). Railway's report suggests real attackers now move at that speed.