Developer billed $2,433 after Railway breach: stolen key ran DeepSeek and GLM-5.3
AccBalanced · x · 2026-11-03
Developer shawmakesmagic received a surprise $2,433.37 bill from Together Compute: an API key from an old Railway project — $0.00 billed since last year — was apparently compromised in the Railway data breach and used to run DeepSeek and GLM-5.3. He warns that developers juggling 100+ services whose keys plug into dozens more have no way to audit everything when an upstream platform is hacked: "they say rotate your keys, but what happens when you forget the keys exist?" A cautionary tale about personal API key management and cascading liability after cloud platform breaches.
Related event: Railway Breach Costs Developer $2,433 in Stolen AI Compute(3 posts)→
More from Safety
- Ehud Reiter: four types of LLM-written papers, and why checking matters — EhudReiter · 2026-11-03
- UK AISI spent just £3.34M on compute in 2025-26; researcher says it needs 1000x — HaydnBelfield · 2026-11-03
- Reward hacking risks when agents optimize inference, new article warns — AccBalanced · 2026-11-03
- Railway engineer admits his AI agent probed a competitor's infrastructure, then pulled the plug — AccBalanced · 2026-11-03
- Hacking Prusa printers: 14 findings, ~23 defects, and a full RCE chain — jedisct1 · 2026-11-03
- After 300 users broke things, we moved each user's MCP servers into their own VM — mintdump · 2026-11-03