Railway Hack and the OpenRouter Breach Claim: Why Attackers Are Stealing AI API Keys, and What to Do

This week, attackers went after the places where developers keep their AI API keys. On October 21, 2026, Railway, a popular platform for hosting apps, confirmed that an attacker got into the systems that store its customers' secret settings and decrypted some of them. Railway says the goal was "compromising AI inference providers," meaning the keys people use to call models from OpenAI, Anthropic, Google and others. A day earlier, dark-web monitoring sites listed OpenRouter, a service that gives one key access to hundreds of AI models, as a breach victim. That claim is not confirmed. And four days earlier, OpenCode confirmed that AI keys stored in its online console may have been exposed.

Update (November 11, 2026): final Railway report and $740K fraud

On November 10, 2026, Railway published its full incident report after the October 21 disclosure. New numbers matter for anyone still using keys that touched Railway before rotation:

Forensics described OIDC misconfiguration, lateral movement, and queries that searched environment variable names for AI vendors before decrypting matching values. Railway stresses customer databases were not accessed and no Railway account logins used stolen credentials.

If you skipped rotation in October, treat this report as the deadline: rotate AI keys, split keys per app, set billing caps, and read AgentBeam's October attack-chain write-up for harness-level lessons alongside our Microsoft Lazarus weight-backdoor coverage.

The short version

First, what is an API key, and why is it so valuable?

When your app talks to ChatGPT's or Claude's models, it sends a secret string called an API key. The key says "bill this account." Developers store these keys as "environment variables," secret settings kept outside the code, often on the hosting platform that runs the app.

That convenience is the risk. A hosting platform like Railway holds the secret settings of thousands of apps in one place. If an attacker gets in, they do not get one key; they get many.

Stolen AI API keys work like credit cards for compute, the target in the Railway breach

Why AI keys specifically? Because they turn straight into money or value:

• Free compute: run expensive models and send the bill to you.
• Resale: sell cheap "AI access" built on stolen keys.
• Distillation: ask a top model millions of questions to train a cheaper copy. OpenCode described its breach as "a large scale distillation attack."

Our guide to what a data breach is and why API keys matter covers the basics, and AgentBeam has a cloud example: attackers making victims pay for Google's Gemini through hijacked billing accounts.

What happened at Railway

Railway's outage started on the morning of October 21 (UTC). Its dashboard, API and command-line tool went down, and new deployments were paused everywhere. That evening, Railway published a security notice:

• Its monitoring spotted unusual activity in the systems that store customer environment variables.
• An unauthorized party "may have accessed encrypted environment variables" and, for some, "obtained the decrypted contents."
• It believes this is "part of a series of attacks recently targeting platform companies," aimed at AI inference providers.
• It told those AI providers to revoke keys, rotated its own storage keys, logged everyone out of the dashboard, and paused all deployments.
• It says the impact "may be limited to a subset of users" and will email affected customers, but tells everyone to change their secrets immediately.

Railway has not yet said how the attacker got in or how they decrypted the values.

What we know about OpenRouter

OpenRouter is a popular "router": one account and one key give you access to models from many companies. On October 20, dark-web monitoring sites reported OpenRouter had been named as a breach victim. On October 21, a law firm said it was investigating, adding that "little information is available at this time." A link it cited hints at about 252,000 users and 208,000 API keys, but nobody has confirmed those numbers. OpenRouter had not confirmed a breach when we published.

Dark-web listings are sometimes exaggerated or built from keys leaked elsewhere. So the honest answer is: unknown. But changing an OpenRouter key takes a minute, and OpenRouter keys were already on the list of keys OpenCode told its users to rotate.

Spending limits on AI API keys contain the damage from breaches like Railway and OpenRouter

Who should act?

The ten-minute AI key checklist

1. Rotate keys that live on hosting platforms, in hosted AI tools or in shared files. Create the new key, update your app, then delete the old one.
2. Set a spending limit on every key. OpenRouter, OpenAI and Anthropic all let you cap spending. A leaked key with a $20 limit is an annoyance, not a disaster.
3. One key per app or tool. If one leaks, you know which, and the others keep working.
4. Check usage in each provider's dashboard since October 16. Look for unknown models, odd hours or sudden spikes.
5. Never put keys in code, screenshots or AI chats. Use environment variables or a secrets manager.
6. Watch your AI coding agents. They read .env files and config. AgentBeam, from the explainx.ai team, asks for approval when an agent reads .env or credential files, which helps you see where copies of your keys end up.

The bigger lesson

AI keys used to be a small line item. Now they are some of the most valuable secrets a developer holds. Attackers are going after the platforms that store many of them at once: a coding tool's console, a hosting platform, possibly a model router. The fix is not to stop using these services. It is to treat AI keys like bank cards: limited, separate, monitored, and replaced the moment something looks wrong.

It has been a heavy security week. The same days brought PHP2Shell, the Node.js security updates and the eMudhra certificate keys. The common thread: keep the foundations updated and the secrets contained.

Common questions

"I didn't get an email from Railway. Am I safe?"

Not necessarily. Railway says it will email the customers it knows were affected, but it also tells every customer to change their secrets. It has not yet explained how the attacker decrypted the values, so the safe move is to assume yours could have been read.

"My app is down because Railway paused deployments. What can I do?"

You can still change keys at each provider and enter the new values in Railway's dashboard. They will take effect once deployments resume. Keep the old key working until then, and delete it as soon as the new one is live.

"How would I even know if someone used my key?"

Open each AI provider's usage page and look at the last week. Warning signs are models you never use, activity at hours your app is quiet, or a sudden jump in spending. If you see any of that, delete the key at once and contact the provider; OpenAI and Anthropic both acted to revoke keys and refund customers after the OpenCode breach.

"Should I stop using hosting platforms or routers like OpenRouter?"

No. Every service that stores secrets carries some risk, including your own servers. What matters is limiting the damage: small spending caps, one key per app, and quick rotation when something goes wrong.

"Is this related to the AI agent that turned off its own monitoring?"

No. That was an internal OpenAI incident with no outside attacker. But both stories point the same way: as AI tools gain access to more systems and money, the controls around them matter more.

Words you might see in other coverage

Related reading on explainx.ai

• Railway engineer's AI agents probed Primcloud: claimed vs verified (November 3, 2026)

• Google GTIG on LLMjacking: LLM Mixers and $1 million bills (November 3, 2026)

• VOLTA infostealer: an LLM called through OpenRouter ranks victims by worth

• Symantec's "Skynet mode" LLMjacking agent: what attackers do with hijacked model endpoints

• OpenCode Console breach: stored API keys and the distillation attack

• What is a data breach? Types, AI agents and API keys

• PHP2Shell explained

• Node.js October 2026 security updates

• FolkBench and API relays: the risks of switching Claude Code and Codex providers

• AgentBeam: Railway breach technical analysis

• October 2026 cyberattacks: the full list of 48 incidents

Sources: Railway security disclosure · Railway status page · Law firm notice on OpenRouter · OpenCode breach summary · OpenRouter key guidance

Accurate as of October 22, 2026. The OpenRouter breach is an unconfirmed claim; we will update this post if that changes.