[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5CNdj-wYVuCiERIik1RMXUcsjBr2PfC0BCEitK8bz0E":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a882c8db-bcf6-497d-b543-b2468a05e6e8","Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges","railway-reveals-how-hackers-used-ai-agents-to-steal-api-keys-and-rack-up-740-000-9b12bd","Railway has revealed how an attacker used AI agents, a build system flaw, and cloud access mistakes to steal customer secrets and generate an estimated $740,000 in unauthorized charges. Its November 10 report describes an attack that crossed several internal systems while engineers worked to close multiple entry points. The findings expand on the earlier […] The post Railway Reveals How Hackers Used AI Agents to Steal API Keys and Rack Up $740,000 in Charges appeared first on Cyber Security News.","Railway disclosed an attack where threat actors used AI agents, a build system flaw, and cloud access mistakes to steal customer secrets, leading to an estimated $740,000 in unauthorized charges. The attack involved exploiting a flaw to escape build system isolation, gaining access to credentials and internal code, which then allowed AI agents to search for weaknesses. A subsequent OIDC trust misconfiguration exposed further cloud credentials, enabling the attacker to decrypt secrets and access AI provider keys, likely for LLMjacking attacks.","Hackers used AI agents and build system flaws to steal API keys and rack up $740,000 in charges.","https:\u002F\u002Fcybersecuritynews.com\u002Frailway-details-data-breach\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FRailway-Details-Data-breach.webp","2026-11-10T17:19:58+00:00","2026-11-10T18:01:12.092767+00:00",8,[17,20,23,25],{"name":18,"type":19},"Railway","vendor",{"name":21,"type":22},"AI agents","technology",{"name":24,"type":22},"OpenID Connect",{"name":26,"type":22},"Temporal","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":31,"value":52,"context":53},"LLMjacking","Type of attack where stolen credentials are used to consume paid AI services at victims' expense.",[18],{"controls":56,"vendors":143},[57,85,114],{"slug":58,"name":59,"problem":60,"products":61},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":58,"product_name":82,"url":83,"description":84},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"slug":86,"name":87,"problem":88,"products":89},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":115,"name":116,"problem":117,"products":118},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-cloud-security","Falcon Cloud Security","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fcloud-security\u002F","Cloud posture management and workload protection.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",[],{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"build-system-escape-and-oidc-misconfiguration-let-attackers-steal-740k-in-ai-api-keys","Build System Escape and OIDC Misconfiguration Let Attackers Steal $740K in AI API Keys","Railway suffered a chained attack where a flaw in build system isolation allowed threat actors to escape the sandbox and access customer secrets and internal code. A subsequent OIDC trust misconfiguration compounded the damage by exposing cloud credentials, enabling decryption of stored secrets and theft of AI provider API keys — likely used for LLMjacking, running unauthorized AI workloads at the victim's expense. This incident illustrates how a single misconfiguration in a CI\u002FCD or cloud trust boundary can cascade into catastrophic credential exposure. The scale of financial harm — $740,000 in unauthorized charges — underscores that secrets stored in build and cloud environments are high-value targets requiring strict isolation and least-privilege controls.",[149,150,151,152,153],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","NIST SP 800-53 SI-17: Fail-Safe Procedures","NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed","MITRE ATT&CK T1552: Unsecured Credentials",{"CIS Control 6: Access Control Management":155,"MITRE ATT&CK T1552: Unsecured Credentials":156,"NIST SP 800-53 SI-17: Fail-Safe Procedures":157,"CIS Control 4: Secure Configuration of Enterprise Assets and Software":158,"NIST CSF 2.0 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed":159},"CIS Control 6 requires least-privilege access and strict control over credentials; the overly broad cloud IAM trust granted via OIDC directly violated this principle and enabled lateral movement to production secrets.","The attackers leveraged the build system escape and OIDC misconfiguration to locate and extract API keys and cloud credentials stored in accessible environments, matching this technique's description of harvesting unsecured credentials.","The build system lacked adequate containment controls to prevent an escaping process from accessing sensitive credentials, which SI-17 addresses by requiring systems to default to a secure state upon failure or unexpected behavior.","The OIDC trust misconfiguration and build system isolation failure are exactly the kinds of insecure default or improperly scoped configurations that CIS Control 4 requires organizations to identify, harden, and maintain.","The OIDC trust relationship granted broader cloud access than intended; this control explicitly requires that access entitlements be scoped, reviewed, and enforced to prevent exactly this kind of privilege overreach."]