---
title: Railway's full incident report: a build-isolation escape, a trusted Temporal client and a bad OIDC binding let an agent-driven attacker decrypt variables in up to 100,000 workspaces | ctxsec
url: https://ctxsec.com/items/railway-final-incident-report-build-escape-temporal-oidc-100k-workspaces-740k-ai-spend
description: "Railway says the attacker began creating accounts on Oct 18, partially escaped build filesystem isolation at 07:28 UTC on Oct 20, and stole a build credential that its internal Temporal cluster accepted as a trusted client. That exposed 353 build histories and a copy of Railway's monorepo, which the attacker mined for re-entry paths and found a misconfigured OIDC binding that yielded short-lived cloud credentials. From there it SSH'd to an orchestration host, took a long-lived decryption credential and pulled encrypted variables, filtering for AI provider key names. Railway puts the upper bound at 1.85% of workspaces (about 100,000), says linked-account tokens for 1,852 users were also decrypted and reset, and estimates about $740,000 of unauthorized AI spend, which it is backstopping where providers won't refund."
status: "official (Railway incident report, Nov 10, 2026, last updated 18:02 UTC); IOCs to be shared publicly after law-enforcement sign-off"
published: 2026-11-10
---

> Railway says the attacker began creating accounts on Oct 18, partially escaped build filesystem isolation at 07:28 UTC on Oct 20, and stole a build credential that its internal Temporal cluster accepted as a trusted client. That exposed 353 build histories and a copy of Railway's monorepo, which the attacker mined for re-entry paths and found a misconfigured OIDC binding that yielded short-lived cloud credentials. From there it SSH'd to an orchestration host, took a long-lived decryption credential and pulled encrypted variables, filtering for AI provider key names. Railway puts the upper bound at 1.85% of workspaces (about 100,000), says linked-account tokens for 1,852 users were also decrypted and reset, and estimates about $740,000 of unauthorized AI spend, which it is backstopping where providers won't refund.

[← Cybersecurity News](/news) · [markdown](/items/railway-final-incident-report-build-escape-temporal-oidc-100k-workspaces-740k-ai-spend.md)

official (Railway incident report, Nov 10, 2026, last updated 18:02 UTC); IOCs to be shared publicly after law-enforcement sign-off

2026-11-10

### Railway's full incident report: a build-isolation escape, a trusted Temporal client and a bad OIDC binding let an agent-driven attacker decrypt variables in up to 100,000 workspaces

- **Attacker tooling:** Railway describes a contest of agent speed against abliterated models and a harness similar to ARTEX, per Wiz, and believes the keys were resold through relay services for distillation.
- **Fixes:** per-build ephemeral VMs with a push-only credential, rebuilt CI with 2FA and biometrics on critical steps, central audit logging of all encrypt/decrypt calls, and narrowly scoped short-lived service credentials.
- **Lessons for any PaaS:** internal job schedulers shouldn't trust build-tier credentials; build caches can leak source; and a single OIDC trust misconfiguration in CI can turn source access into cloud access.
- Railway reported the attack to the FBI's IC3. If you had AI keys in Railway variables in October, rotate them and file unauthorized charges through Railway's form.

Sources: [Railway: Incident Report: October 21st Security Attack (Nov 10, 2026)](https://blog.railway.com/p/incident-report-october-security-incident)