Railway security incident harvests API keys: Claude user hit for $80, revocation urged
Site-Staff · reddit · 2026-10-22
A Reddit user reports that API keys stored in Railway environment variables were harvested and abused while running Claude Hosted Apps — losing $80 before Anthropic detected the anomaly and halted auto-reload. Users are urged to disable any keys used on Railway.
Railway's status page confirms the incident: it is rotating all bucket credentials, deployments (including Enterprise) are paused, and it strongly recommends revoking all stored environment variables — API keys and private registry credentials alike — and reviewing service logs. Affected accounts will be contacted by email.
Related event: Railway breach exposes encrypted env vars, users urged to rotate all keys(11 posts)→
More from Safety
- Veteran vuln researcher: agents will soon find zero-days by pointing at a source tree — teropa · 2026-10-22
- Claimed unpatchable PyTorch autograd zero-day runs arbitrary code via SGD — burny_tech · 2026-10-22
- Twitter product lead: the real AI threat is humans using AI to hurt humans — nikitabier · 2026-10-22
- Greentext dev nightmare: php2shell, GitLab patch, opencode breach, LiteLLM supply chain hit in one day — Bedrovelsen · 2026-10-22
- Team-shared AI agent permissions: a Slack bot quietly hands everyone its database access — Careless_Love_3213 · 2026-10-22
- Crypto keys drained from Railway: $371K swept across 500+ txns on 19+ EVM chains — banteg · 2026-10-22