Journal22 October 2026

Someone is collecting AI keys

Fireworks AI, OpenCode and now Railway. Three platforms in fifteen days, each breached for the same kind of thing: the keys their customers trusted them to hold.

Hardline JournalSydney & Melbourne · 4 min read

On Wednesday, Railway, a hosting platform popular with software developers, told its customers that someone had been inside the systems where it keeps their secrets. Not their websites, their secrets: the passwords, database logins and API keys their software uses to talk to everything else. For some customers, the attacker got those secrets in plain text.

Railway paused every deployment on its platform, asked AI companies upstream to cancel keys, and told every customer to change every secret they'd stored with it. Then it said the part that matters most: it believes this is one of a series of recent attacks on platform companies, aimed at getting into AI providers.

Why AI keys

An AI key is a credit card for computing. Whoever holds it can run the most capable models in the world, as much as they like, on someone else's bill. When OpenCode's customers' keys were taken, TechCrunch reported unauthorised charges on their OpenAI, Anthropic and Google accounts, some in the hundreds of dollars and a few over a thousand.

The bills are the visible part. Stolen access to frontier AI is useful for exactly the work we've been writing about: research on targets, convincing messages at scale, and finding weaknesses in software. The companies that sell AI watch their own customers closely. A stolen key lets someone borrow a customer's good name.

Every company you hand a key to becomes a place that key can be stolen from.

Why it's the platforms

None of these customers did anything wrong. Each made a sensible choice: store the key with a trusted platform, so their software can use it. That convenience means one platform ends up holding thousands of keys, which makes it the most efficient place to rob.

It's the same pattern as the target in our essay. The weak point usually isn't you. It's the accountant's software, the property manager's portal, the platform your developers picked. You can do everything right and still be exposed by someone you trusted with access.

What to do

Ask anyone who builds software for you. Your company, the family office, a startup you've backed. Do you use Railway, OpenCode or Fireworks AI? If so, have you changed every key and password stored there since the disclosures?
Put a ceiling on every AI account. OpenAI, Anthropic and Google all let account owners set spending limits or budget alerts. A stolen key with a limit is an annoyance. Without one, it's an open tab.
Check what's connected to your own accounts. Google, Microsoft and Apple each list the apps you've given access to. Remove anything you don't use. Each one holds a key to you.
Ask your vendors one question. Where are our keys stored, and who can read them? A good answer is specific. A vague one tells you what you need to know.

Or have someone keep that list for you. Knowing which companies hold keys to your family, and checking on them when the next platform falls, is what private cybersecurity is for.

Sources

More from the journal

All posts