Railway's full incident report: a build-isolation escape, a trusted Temporal client and a bad OIDC binding let an agent-driven attacker decrypt variables in up to 100,000 workspaces
- Attacker tooling: Railway describes a contest of agent speed against abliterated models and a harness similar to ARTEX, per Wiz, and believes the keys were resold through relay services for distillation.
- Fixes: per-build ephemeral VMs with a push-only credential, rebuilt CI with 2FA and biometrics on critical steps, central audit logging of all encrypt/decrypt calls, and narrowly scoped short-lived service credentials.
- Lessons for any PaaS: internal job schedulers shouldn't trust build-tier credentials; build caches can leak source; and a single OIDC trust misconfiguration in CI can turn source access into cloud access.
- Railway reported the attack to the FBI's IC3. If you had AI keys in Railway variables in October, rotate them and file unauthorized charges through Railway's form.
Sources: Railway: Incident Report: October 21st Security Attack (Nov 10, 2026)