GREG ISENBERG (@gregisenberg) · 10/22/2026, 07:08:40
Railway Hacked: AI API Keys Targeted for Compute Theft
Railway was hacked with attackers specifically targeting stored AI API keys to steal compute resources. This incident highlights critical security vulnerabilities in agent-based applications, prompting immediate recommendations for key rotation and hard spend limits.
SOURCE COVERAGEFull Original Report
GREG ISENBERG (@gregisenberg) · 2026-10-21 23
I think we’ll see a lot more of this.
The attackers were going after the AI keys stored on Railway, because an API key is basically a credit card for compute now.
Every company running agents is sitting on a pile of these keys!
here’s the 10 minute fix. rotate every key tonight, set a hard monthly spend limit in each AI dashboard, give every agent its own key, and turn on usage alerts so you know the second something spikes.
someone should build the tool that finds every AI key a company has, rotates them every week and pings you when spend looks weird. charge $99 a month. every startup running agents needs it yesterday.
↳ 引用 @AndrewCurran_ (Andrew Curran): Railway has been hacked.