Stolen AI API Keys Expose Businesses To Fraudulent Cloud Bills

A security breach at cloud hosting provider Railway has exposed the financial risks organisations face when attackers gain access to artificial intelligence credentials, with compromised customer keys linked to an estimated US$740,000 in unauthorised usage.

Railway disclosed the findings on 10 November following an attack that took place between 20 and 21 October. According to the company, the attacker exploited a vulnerability in a build environment before gaining access to credentials used to decrypt customer variables.

The intruder then searched Railway’s production database for credentials associated with AI providers. The compromised information included AI API keys, as well as some cloud, database and payment service credentials.

The stolen AI keys were subsequently used to access AI services and generate unauthorised usage charges. Railway said the potential exposure affected up to 1.85% of its workspaces, approximately 100,000, although it could not confirm how many credentials were actually taken.

The company also reported that linked-account tokens belonging to 1,852 users were stolen and have since been reset. It found no evidence that customer databases were accessed or that code repositories were downloaded.

The incident highlights how exposed AI credentials can translate directly into financial losses. In February, a developer at a small Mexican startup reported an unexpected Google Cloud bill of US$82,314.44 after a stolen API key was used to access Gemini models. The company normally spent about US$180 monthly.

The financial impact of such incidents can depend on whether cloud and AI providers reimburse fraudulent usage.

Railway initially said it could not refund customers for spending associated with compromised API keys. In its November disclosure, however, it said it would cover breach-related charges where AI providers declined reimbursement.

According to Railway, refunds from AWS Bedrock and Google Gemini have started, while OpenAI is reviewing claims individually. Discussions with Anthropic are ongoing, with Railway covering the associated costs in the meantime. The company said it would also absorb charges incurred through OpenRouter, which does not offer refunds.

A separate incident involving NEAR AI points to another area of risk: the software used to run AI models. The company disclosed that an attacker exploited a remote code execution vulnerability in the open-source SGLang inference engine, potentially exposing user requests processed on an affected server. Some account information and API keys were also affected, with the exposed keys revoked.

For organisations deploying AI services, the incidents underline the need to treat API credentials as sensitive financial assets. CIOs and security teams need to know where AI keys are stored, who can access them and whether spending limits are configured across providers.

Regular credential rotation, monitoring of AI usage and prompt investigation of unusual charges can help limit exposure. Organisations running their own AI inference infrastructure must also ensure that the underlying software is patched and secured.