Railway Sandbox Escape Hit 100,000 Workspaces

If your project's secrets sit in a hosted build sandbox, this one deserves two minutes. Railway says an attacker broke out of its build isolation and may have decrypted secrets for close to 100,000 workspaces.

The stolen keys ran up an estimated $740,000 in charges. Railway thinks they were sold on to feed AI model distillation.

What Happened

Railway published a full postmortem on the incident. The attacker was using AI models with their safeguards stripped out, and the way in was a previously unknown bug in Railway's build isolation.

From there, a misconfigured cloud login led to the database of encrypted secrets. Railway says credentials for up to roughly 100,000 workspaces may have been decrypted.

The keys were then used to run up an estimated $740,000 in charges. Railway believes they were sold on to feed AI model distillation, the process of training one model on another model's output.

Railway describes the whole thing as "a contest of agent speed" — attackers working with automated agents against defenders trying to keep up.

Why It Matters

The lesson is not really about Railway. Any platform that builds your code in a shared sandbox holds the keys your project runs on, and a bug in that isolation plus one bad cloud login is enough to reach all of them.

If you have API keys, tokens or credentials stored with a hosting or build provider, treat this as a reminder to check what that provider can see and to rotate anything you are not sure about. A leaked key is not just a bill — it is whatever the person holding it decides to do next.