Railway publishes detailed forensic follow-up

The first break occurred when a build workload read files belonging to its host virtual machine. A builder credential then authenticated to an over-trusting Temporal build-history service, exposing 353 build histories and allowing retrieval of Railway internal source. The attacker used that source to identify a misconfigured CI-to-cloud OIDC trust relationship; a short-lived credential then reached provisioning SSH keys and an orchestration host able to retrieve encrypted customer variables and call the upstream KMS.

Railway places the unauthorized variable decryption during October 21 and reports a maximum possible exposure of 1.85% of workspaces, approximately 100,000, rather than 100,000 confirmed individual victims. Linked-account tokens for 1,852 users were exposed and reset; Railway estimated roughly $740,000 of unauthorized AI consumption. Railway says its logs identified AI-provider credential names as a primary search target. The company describes the adversary as using abliterated models and rapid agent fan-outs, and attributes an ARTEX-like harness comparison to Wiz; those descriptions are not an independently reconstructed model-to-command trace.

Production breach at Railway, not an ARTEX attribution. No customer repository snapshots were found taken according to the victim report; the AI credential targeting and observed post-theft consumption matter independently of the exact agent harness.

The 1.85% figure is an upper bound over environments that could have been decrypted, not a count of keys or confirmed affected users. Railway hypothesizes resale and distillation use; it has not tied downstream buyers to the original operator. The link to the separately reported Primcloud agent-probing dispute is not established.

Railway's final chronology starts earlier than the public detection alert. A builder was probed on October 20 and a filesystem-isolation weakness was exploited at 07:28 UTC, exposing a build credential. After the first route was closed, the intruder used codebase knowledge and a separate cloud OIDC trust weakness to obtain further short-lived authority. That chain eventually reached an orchestration machine with the keys needed to decrypt some envelope-encrypted customer variables. Railway logged targeted database selection of AI provider key names and key-service decryption between October 21 04:42 and 07:14 UTC.

The numbers measure different outcomes. At most 1.85% of workspaces, approximately 100,000, were in environments whose encrypted variables could have been decrypted; those are not confirmed exposed keys. Railway also identified 353 build histories read, 1,852 users' linked-account tokens exposed and approximately $740,000 in estimated unauthorized use of stolen AI credentials. The company says source-repository snapshots and customer databases were not found accessed. It characterizes the actor as using modified models and high-speed offensive automation, but Wiz's ARTEX-like-harness analogy is not proof ARTEX itself operated the attack.

Railway accelerated migration to one ephemeral build VM per job, replaced long-lived shared builder authority with image-specific credentials, revoked cloud sessions and coordinated credential rotations with issuers. These changes act at different points in the demonstrated chain. They cannot retroactively invalidate an already copied third-party API key unless its issuer revokes it, or prove that an independent downstream token-reseller belongs to the original Railway intruder.