Compromised Railway API key racks up $2,433 Together AI bill running DeepSeek and GLM
SuB8u · x · 2026-11-03
Developer shawmakesmagic got a $2,433.37 bill from Together AI: an API key from a dormant Railway project was compromised in the Railway hack and used to run DeepSeek and GLM inference.
The threaded discussion highlights a structural pain: developers now juggle 100+ services whose secrets are wired into dozens of others, so any upstream breach means manually auditing every key — and "rotate your keys" is useless for keys you forgot existed. Dormant agent-era API keys silently burning four-figure bills is the inverse of finding crypto dust in old wallets.
Related event: Railway Breach Exposes AI API Keys as Hackers Rack Up Bills(2 posts)→
More from Safety
- Retail AI vision now tracks exactly what you look at in stores — nikola_mr64990 · 2026-11-03
- NYT, Daily News sue Brave for scraping stories and reselling them to AI giants like Anthropic and Perplexity — nordicinst · 2026-11-03
- Geoffrey Irving rebuts Scott Alexander: a stronger version of unilateral AI pauses still holds — geoffreyirving · 2026-11-03
- Geoffrey Irving says Scott Alexander's 'Against SURA' attacks a strawman — geoffreyirving · 2026-11-03
- Muse has paid out $1.2M in bug bounties, with a record $300K for one critical auth bug — armand_ruiz · 2026-11-03
- Dev accuses Railway employee Jake Runzer of attempting to breach his infrastructure — ayushtweetshere · 2026-11-03