Railway env vars may be exposed. Here's what to do with your AI API keys

Railway has notified customers that an unauthorized party accessed the system that manages environment variables on its platform, and that some of that data may have been obtained in decrypted form. Railway says the impact may be limited to a subset of users, and the full scope is still under investigation.

This post only covers AI API keys, because they are an asset where you can still ask for a refund after the damage is done. Railway described the attack as part of a series targeting platform companies with the aim of compromising AI inference providers, but reports based on on-chain analysis also suggest that some funds were drained from victims who had stored crypto wallet private keys. Crypto is much harder to recover than SaaS spend, where AI providers and cloud platforms at least have a refund process. If you had a wallet private key in Railway, moving the assets in that wallet should be your first priority.

Leaked API keys tend to get used quickly. In most of the cases we’ve looked at, they were resold to API relay services or used without permission for benchmark jobs, role-play bots with heavy users, and expensive image generation, and the damage often grew to thousands of dollars in a very short time.

If you stored OpenAI, Anthropic, Google Gemini or other AI keys in Railway, a third party may have been able to access them. If so, follow the steps below to protect yourself.

1. Rotate every AI key that touched Railway

Do this before anything else, even if you don’t see unusual usage yet.

• If a key suddenly stopped working, it may have already been revoked. Railway says it asked upstream AI providers to revoke keys proactively. Issue a new one.
• Revoke the old key even if you can’t deploy right now. Railway has paused builds and deployments, so revoking may take your app down until you can ship the new key. That downtime is still far cheaper than a leaked key running for days.
• Create a new key in each provider’s console, update it in your app as soon as you can deploy, and make sure the old one is deleted.
• Don’t stop at the key you remember. Check every Railway project and service, including old toy projects. Old, forgotten keys are the ones that get abused for months.
• If the same key was also used locally, in CI, or on another host, rotate it there too.

2. Check usage for the exposure window

Open the usage or billing page for each provider and look at the last few days, per key if possible.

Red flags:

• Models your app never calls (image, video, TTS, or a more expensive tier)
• Traffic at hours you weren’t running anything, especially 24/7 flat traffic
• A high share of errors (rate limits, 400s), which usually means a script hammering the endpoint
• Usage many times your normal daily spend Screenshot what you find now, with dates and times visible. Dashboards can change and you’ll want this later.

3. Cap the damage

A rotated key stops this leak. A spend cap limits the next one.

• OpenAI: set a project budget and usage limits for each project.
• Anthropic: set a monthly spend limit in the Console, and think twice about leaving auto-reload on. Unauthorized auto-recharge charges are some of the hardest to get back.
• Google Gemini: Cloud Billing budgets only send alerts, they don’t stop spending by themselves. Set per-API quotas on the Generative Language API, restrict keys by API and by IP or referrer, and turn on budget alerts.

4. If unauthorized charges already showed up

How you contact support matters more than people expect. In cases we’ve looked at, the first message often decides how the whole case gets classified. A panicked “I got hacked, refund me” is easy to close. A clear message with a timeline is not.

Before you write in, have this ready:

• When the key was created, when it was exposed (point to the Railway incident), and when you revoked it

• The key ID or name (never the full key)

• Usage screenshots showing the spike, and your normal baseline for comparison

• What you’ve already done: rotated, capped, removed from Railway Then, by provider:

• OpenAI has dedicated forms for unauthorized charges and account compromise. Use those rather than general support. In a case we followed, the credit came back as account credits about three weeks later.

• Anthropic has no dedicated form, so it goes through support. If auto-reload fired multiple times, list every charge individually. We’ve seen cases where only one of many charges was refunded because the rest weren’t explicitly raised.

• Google goes through a billing dispute in the Cloud Console. If Google sent you its own security or compromised-key notice, ask for that case number to be linked to the billing dispute, and ask for the disputed amount to be put on hold before the invoice closes. Credits are easier inside an open billing period. Write it once, clearly, and attach everything. One complete message beats five angry follow-ups.

Need help?

If you were hit and you’re not sure what to send, reach out at hello@brello.app. We’re collecting what actually works with each provider and we’ll help you put the first message together for free.