Railway
CompanySecurity timeline
- Named in breach reports by BleepingComputerNorthflank investigates misuse of AI keys and urges customers to rotate secrets
Recent news
Railway employee's AI testing agents tried to access rival Primcloud's infrastructure
Railway senior product engineer Jake Runzer ran AI testing agents against Primcloud, a rival platform, without authorisation, and halted the harness after it reached too far. Primcloud founder Josh Manders says the agents tried to pull credentials from an application container, request platform secrets, access cloud metadata, find internal databases and scan all 65,536 addresses on the internal network twice. Primcloud says its defences blocked everything, and CEO Jake Cooper has pledged to prohibit non-manual external testing. Experts argue that blaming a "rogue AI" does not establish accountability, and that delegating work to an agent also delegates the authority of the identity it uses.
Northflank investigates misuse of AI keys and urges customers to rotate secrets
Northflank is investigating reported misuse of AI API keys and has told customers to treat environment variables, secret groups and global settings as potentially compromised. The entry point, the attacker and the affected customers are not yet confirmed, and the company's timeline does not explain what its network policy patches fixed. Wiz's threat alert and incident response team were involved, and the company says the activity may fit a wider pattern of LLMjacking seen across AI developer platforms, as well as the recent Railway incident.