Railway 密钥库遭入侵，AI API 凭证泄露致服务暂停GREG ISENBERG (@gregisenberg)T1智能体与协同

GREG ISENBERG (@gregisenberg) · 2026/10/22 07:08:40

Railway 遭黑客攻击 AI API 密钥成算力盗用目标

出处作者 / 发布主体：GREG ISENBERG (@gregisenberg)原标题：I think we’ll see a lot more of this.

45AI 研判分

核心综述

Railway 平台遭遇黑客攻击，攻击者专门窃取存储其中的 AI API 密钥以盗用算力。该事件凸显了智能体应用中密钥管理的严重安全隐患，建议立即轮换密钥并设置硬性支出限额。

报道全文原始报道全文

GREG ISENBERG (@gregisenberg) · 2026-10-21 23

I think we’ll see a lot more of this.

The attackers were going after the AI keys stored on Railway, because an API key is basically a credit card for compute now.

Every company running agents is sitting on a pile of these keys!

here’s the 10 minute fix. rotate every key tonight, set a hard monthly spend limit in each AI dashboard, give every agent its own key, and turn on usage alerts so you know the second something spikes.

someone should build the tool that finds every AI key a company has, rotates them every week and pings you when spend looks weird. charge $99 a month. every startup running agents needs it yesterday.

↳ 引用 @AndrewCurran_ (Andrew Curran): Railway has been hacked.