Railway says an attacker may have read customer environment variables as part of a series of attacks aimed at AI inference providers. What Railway has confirmed and what it has not, why a stolen AI API key works like cash, how distillers and reseller networks use stolen keys, the second-order effects of anti-distillation defenses, and a 10-minute checklist: rotate, cap, one key per agent, alerts.
The Railway Breach and the Black Market for AI Keys: Why a Stolen Token Is Cash
