Attackers are exploiting a simple but costly gap: stolen credentials that let them run AI inference at someone else’s expense. This attack pattern has a name: LLMjacking. Unlike cryptojacking, which slowly siphons compute power to mine cryptocurrency, LLMjacking routes high-volume AI inference requests through stolen credentials and can produce six-figure charges within hours.
Railway: One Breach, Hundreds of Thousands of Exposed Workspaces
A build-infrastructure compromise at Railway exposed customer secrets on a scale that illustrates how centralized hosting platforms concentrate credential risk.
Attackers began probing Railway, an application-hosting platform, on October 20, 2026, exploiting multiple weaknesses in its build infrastructure to reach internal credentials and customer environment variables. The breach affected a maximum of roughly 100,000 workspaces, representing the potentially exposed population rather than a confirmed count of stolen secrets, and exposed API keys and GitHub OAuth tokens belonging to 1,852 users.
Those stolen keys were used against Amazon Bedrock, OpenAI, Anthropic and Google Gemini, according to Railway. Railway disclosed approximately $740,000 in unauthorized AI usage; the Wall Street Journal reported total losses exceeded $1.1 million when roughly $371,000 in cryptocurrency theft is included.
Affected credentials were reset promptly, and the company said it would cover fraudulent charges that providers declined to refund. Railway also assessed that attackers may have used models with safety restrictions removed, though it has not confirmed whether the keys powered a broader resale operation.
Zeabur: A Separate Breach, Another Six-Figure Bill
A concurrent incident at Zeabur shows that the same credential-theft playbook is being applied across multiple developer platforms simultaneously.
Zeabur, a separate developer infrastructure provider, disclosed its own October 2026 breach in which stored API keys were exposed. Per Wall Street Journal reporting, stolen Zeabur credentials generated approximately $100,000 in fraudulent charges.
Zeabur said it could not absorb third-party service costs directly and would assist customers in seeking refunds. The company separately announced it will cease operations on December 31, 2026; the relationship between that decision and the breach has not been established.
The Supply Chain Behind Stolen AI Access
Google Threat Intelligence Group and Mandiant documented a layered criminal model in which credential theft, access aggregation and AI resale can operate as separate functions.
One group steals credentials by scanning for exposed endpoints or extracting keys from poorly protected repositories. “LLM mixer” services then resell that access to end users who submit prompts through hijacked accounts, while the legitimate account holder receives the provider’s bill.
Google identified one token-routing service called Jet Night that processed more than 500,000 API calls in under eight hours, pushing nearly $1 million in costs to the victim organization.
Why One Platform Breach Can Drain Thousands of Accounts
The way developer platforms handle stored secrets creates a concentration risk that a single infrastructure compromise can exploit at scale.
Developer platforms store secrets in environment variables so deployed applications can reach databases and AI providers without hardcoded credentials. That design means one infrastructure compromise can expose keys belonging to thousands of downstream customers.
API keys may function as bearer credentials, meaning possession can be sufficient to submit requests and incur charges without a password. Because AI providers bill by token consumption, the financial damage can arrive suddenly rather than building gradually enough to register in routine monitoring.
Who Pays When Accountability Is Shared
In both incidents, financial recovery became a negotiation among three parties rather than a straightforward reimbursement.
Financial recovery at Railway and Zeabur involved the hosting platform, affected customers and the AI or cloud providers, based on the companies’ own disclosures. Charge totals from both incidents may still change as providers investigate disputed usage and decide on refunds.
The Controls That Make This Harder to Pull Off
The access patterns documented by Google, Railway and Zeabur point directly to a set of defensive measures that can reduce both exposure and the speed of financial damage.
Scope API keys narrowly, rotate them regularly, and store stolen credentials in dedicated management systems rather than broadly accessible environment variables. Set spending and rate limits on AI accounts, and configure alerts for unusual token volume or access to models an account has never previously used, to shorten the window between compromise and containment.
