Platform-as-a-Service (PaaS) provider **Railway** announced on Wednesday that it had detected "anomalous activity" within systems responsible for storing customer environment variables. Further investigation revealed that an unauthorized third party likely gained access to encrypted environment variables, and in some instances, managed to obtain their decrypted contents. While the company stated the impact was limited to a "subset of users," an exact number was not disclosed. Environment variables are crucial user-defined key-value pairs that secure sensitive information such as API keys, database credentials, and feature flags. They are configured at the operating system or container level to avoid hard-coding values directly into application source code. **Railway** suspects this incident is part of a coordinated series of attacks aimed at platform companies, with the ultimate objective of compromising artificial intelligence (AI) inference providers. The company has proactively informed upstream providers to revoke potentially compromised keys to prevent their misuse. ### Recommended Actions for Users Customers are strongly advised to take immediate precautionary measures: * Rotate all environment variables, including API keys, stored within **Railway**, as well as private registry credentials. * Thoroughly review service logs for any unusual or suspicious activity. ### Cryptocurrency Wallets Drained According to security researcher **@tayvano_**, this incident has also enabled attackers (identified by the Ethereum address **0xd9773325282874d18cb83f1fe50f14c39750b2ee**) to drain cryptocurrency wallets whose private keys were stored on **Railway**. The first known cryptocurrency theft transaction reportedly occurred at 7:36 p.m., at least two hours prior to the official disclosure of the incident. In response, **Railway** has rotated all **Railway** bucket credentials and invalidated **Railway** API tokens. The company has also restored builds for Pro and Enterprise workspaces, allowing customers to implement new credentials. While builds remain available for these tiers, **Railway** is actively working to re-enable builds for Hobby, Free, and Trial accounts, addressing ongoing issues with failing builds and extended deployment queue times. ### The Rise of LLMjacking This development underscores a worrying trend where threat actors are not only integrating AI into various stages of the attack lifecycle but also gaining unauthorized access to cloud environments to run Large Language Models (LLMs), leaving victims to cover the substantial compute costs. This practice is increasingly known as **LLMjacking**. Earlier this week, **Wiz** documented a case where threat actors compromised privileged **Google Cloud Platform (GCP)** credentials. They then linked external, attacker-controlled **GCP** projects to the victim's internal billing accounts. The attack vector involved sponsored ads on **Google Search**, which redirected users searching for terms like "google cloud" or "gap" to a deceptive Google login page via a **Google Sites** redirect. This allowed attackers to harvest account credentials and multi-factor authentication (MFA) codes. Upon gaining access to the victim's **GCP** environment, the threat actor exploited excessive privileges to deepen their access, bypass security controls, and add external, attacker-controlled Gmail accounts directly to the organization's billing account. "Because the AI workloads were processed in foreign projects, prompt contents and model outputs remained completely hidden from the victim organization, leaving the nature of the mass AI usage unknown," **Wiz** researchers Shira Ayal and Andre Maccarone stated. ### Autonomous Cybercrime with AI Agents  These resource abuse cases are not isolated incidents. The **Symantec Threat Hunter Team** has observed attackers targeting exposed LLM endpoints to power autonomous cybercrime operations. These operations are capable of internet-wide scanning, vulnerability exploitation, credential theft, and cryptocurrency mining, all without human intervention, for up to 100,000 steps. This activity is driven by an offensive AI agent operating in a "Skynet mode," which scans and infects targets with miners, enabling threat actors to launch further attacks. Exploits have targeted deployments of **Microsoft Visual Studio Code**, **Django**, **Jupyter**, **Laravel**, **Supabase**, **Next.js**, and **Flask/Werkzeug**. The ultimate goal is free inference. Instead of simply using AI to generate malicious content, the malicious AI agent leverages hijacked AI models to plan and direct attacks, shifting compute costs to the legitimate owner and obscuring the attacker's identity. In essence, the strategy is to develop a malicious agent that can hijack a legitimate AI system, transforming it into "a devoted companion that must never refuse" and an unwitting tool for cybercrime. "The captured instructions defined a single agent equipped for internet-wide scanning, exploitation of several common web frameworks, database theft, credential and secret harvesting, and cryptocurrency mining," the **Symantec Threat Hunter Team** detailed in a report. "The activity is a form of LLMjacking, where attackers steal access to someone else's AI model so that the victim pays for the computing power." Dick O'Brien, principal intelligence analyst at the **Symantec Threat Hunter Team**, clarified that while there's no direct evidence linking their observed activity to the **Railway** incident, both share a common thread: the value of API keys for AI models. These keys allow anyone possessing them to run inference at the owner's expense. O'Brien noted that their honeypot data showed extensive spraying of stolen keys against model endpoints, suggesting that keys taken from a platform's stored environment variables could be similarly abused, though **Railway** has not confirmed such abuse in this instance.