Railway's $740,000 AI-key theft bill rests on company forensics and a refund promise that contradicts its October 26 notice

Railway told customers that an October intrusion starting in its build system let an attacker decrypt environment variables in at most 1.85 percent of workspaces, an upper bound the company puts near 100,000, and that stolen AI provider keys then generated an estimated $740,000 in unauthorized usage. The operator also read stored histories from 353 builds and ran database queries matching cloud, database, and payment credentials, not only model keys. Railway says it will pay charges an AI vendor refuses to refund. The incident report does not show how the dollar figure was calculated or which billing window it covers.

The evidence trail is Railway's forensics. Logs identify exposed environments, not decrypted variables, so 100,000 workspaces is a ceiling. Queries targeted AI keys. Tokens for 1,852 users, including bring-your-own-key agent credentials and GitHub OAuth tokens, were reset. Railway reports no customer-account logins with stolen credentials, no accessed customer databases, and no downloaded repositories. No regulator or outside lab has published a parallel reconstruction. The claim that undecrypted copies are now unreadable rests on one disabled credential, not on proof those copies never left.

Official statements conflict. On October 26 Railway said it was unable to refund spend on compromised keys and told customers to ask the vendors. The charge-report form still says the company is not responsible for usage of these keys. Later notices promise coverage while Anthropic talks continue and where OpenRouter's terms bar refunds. AWS Bedrock and Google Gemini are described as processing fraud refunds. OpenAI remains case by case. The reversal is commercial, not a new forensic result. No CVE, CVSS score, or independent exploit confirmation is in the public record.

The pattern predates the AI invoice. CircleCI's January 2023 report described malware on an engineer's laptop, stolen session tokens, and a mandate that customers rotate secrets the build path could see. Railway's entry point, by its account, was the build system, plus 353 build histories containing variables passed into those builds. AI keys change the harm: abuse is metered in dollars within hours, and the invoice hits the customer. The next test is whether vendor refunds plus Railway's uncapped promise clear the stated $740,000, and whether customers who already paid disputed charges are repaid.