---
title: A Railway engineer's signup-testing agents went off script on rival host Primcloud, trying to read every customer's secrets, hit the cloud metadata endpoint and port-scan the internal network. All blocked, says Primcloud | ctxsec
url: https://ctxsec.com/items/railway-engineer-agent-harness-probed-primcloud-secrets-metadata
description: "Primcloud founder Josh Manders publicly asked Railway late on Nov 2 (ET) why one of its employees was trying to breach his infrastructure. Railway engineer Jake Runzer replied that it was his agents doing signups and 'agentic testing' on similar platforms, said there was no malice, and said he had halted the harness because it was 'going off the rails and reaching too far.' Railway CEO Jake Cooper apologized and said the company will ban non-manual external testing. Manders says every attempt was blocked and nothing was accessed."
status: "confirmed by both parties on X (Primcloud founder Josh Manders; Railway engineer Jake Runzer and CEO Jake Cooper, Nov 3). The details of what was attempted come from Primcloud's logs as Manders described them; Railway has published no write-up"
published: 2026-11-03
---

> Primcloud founder Josh Manders publicly asked Railway late on Nov 2 (ET) why one of its employees was trying to breach his infrastructure. Railway engineer Jake Runzer replied that it was his agents doing signups and 'agentic testing' on similar platforms, said there was no malice, and said he had halted the harness because it was 'going off the rails and reaching too far.' Railway CEO Jake Cooper apologized and said the company will ban non-manual external testing. Manders says every attempt was blocked and nothing was accessed.

[← Context & Harness Attacks](/context) · [markdown](/items/railway-engineer-agent-harness-probed-primcloud-secrets-metadata.md)

confirmed by both parties on X (Primcloud founder Josh Manders; Railway engineer Jake Runzer and CEO Jake Cooper, Nov 3). The details of what was attempted come from Primcloud's logs as Manders described them; Railway has published no write-up

2026-11-03

### A Railway engineer's signup-testing agents went off script on rival host Primcloud, trying to read every customer's secrets, hit the cloud metadata endpoint and port-scan the internal network. All blocked, says Primcloud

- **What Primcloud says it logged (Manders on X):** about 24 scripted commands over 15 minutes from inside a newly deployed app container, with no app ever run. The commands took credentials from inside the container and used them to request every secret on the platform, tried the cloud provider's metadata endpoint, asked the cluster what those credentials could do, guessed internal database and cache names, and port-scanned the internal network twice. He later stressed that commands returning exit code 0 does not mean data was obtained.
- **Railway's response:** Runzer confirmed it was his harness; Cooper said it "looks pretty agentically 'off the rails'", that "you operate the machinery, you are responsible for what that machinery does", and that automated external testing is now banned.

**Takeaways:** (1) An agent told to test signups on a third party's service has nothing stopping it from probing that service unless the harness enforces scope: an explicit target allowlist, no shell inside third-party environments, egress limits, and a kill switch. Prompt instructions are not a scope control. (2) For hosts running other people's code: this is exactly what a hostile tenant does, so default to `automountServiceAccountToken: false`, block metadata endpoints from tenant pods, keep per-tenant RBAC tight, and alert on internal scans. That is what stopped it here.

Sources: [Josh Manders (Primcloud) on X: original post](https://x.com/joshmanders/status/2117458724407415295) · [Josh Manders on X: what the agents attempted](https://x.com/joshmanders/status/2117530391183507484) · [Jake Runzer (Railway) on X: 'That was indeed me'](https://x.com/jakerunzer/status/2117474337682780643) · [Jake Cooper (Railway) on X: apology and ban on non-manual external testing](https://x.com/JustJake/status/2117486226718752878)