Railway security incident: if you host apps or agents there, rotate your keys

Railway, a popular hosting platform for apps and agents, said on 21 October that an unauthorised party may have accessed customers' stored environment variables (where API keys and passwords usually live), in some cases decrypted, and told all users to replace every variable, API key and private registry credential and check their logs. Railway believes it's part of a wider series of attacks on platform companies aimed at AI model providers and has asked those providers to revoke keys; at its last status update (23:45 UK time on 21 October) builds were still paused, so you may not be able to redeploy with new keys straight away.

Why it matters@gregisenberg's point applies whether you use Railway or not: an AI API key is effectively a credit card for compute. His 10-minute fix is to rotate your keys, set a hard monthly spending limit in each AI dashboard, give every agent its own key and switch on usage alerts.

How we knowCompany figures are labelled as their own claims; anything we couldn't verify is labelled as a report or a claim.