The short version: When thieves stole AI keys from the hosting platform Railway in October, the estimated $740,000 in unauthorized AI spending landed on the key owners, and whether they get it back depends on which AI company issued the key. Railway’s November 10 incident report says AWS and Google are refunding under their fraud policies, OpenAI is reviewing claims case by case, Anthropic is still in talks, and OpenRouter has refused. On paper, every one of those providers puts the bill on you: OpenAI, Anthropic and AWS each say in their own terms, read today, November 11, 2026, that the customer is responsible for all activity on its account. Every refund in that table is a choice, not a right.
That matters even if you have never heard of Railway. If a freelancer or agency built your booking chatbot, quote tool or customer-service assistant, there is a good chance your OpenAI, Claude or Gemini key sits inside somebody else’s hosting account. This is what happens to that key, and to your money, when that somebody else is breached.
What happened at Railway, in plain terms
Railway is a cloud platform where developers run apps without managing servers. Many of those apps store an AI provider key as an “environment variable,” a setting the app reads when it starts. In its incident report published November 10, Railway says an attacker first broke out of its build system on October 20, then used a misconfigured cloud login and a credential left in a file on an internal machine to decrypt stored variables early on October 21.
The attacker was not browsing at random. Railway says it “queried variable names for AI provider keys and decrypted the keys.” Its preliminary report from October 22 says the goal was to obtain AI provider keys “to perform distillation attacks,” which means running huge numbers of prompts through a strong model to train a cheaper copy of it. Your key is valuable to a thief for the same reason it is valuable to you: it unlocks a frontier model and sends the bill to someone else.
Railway puts the upper bound at 1.85 percent of workspaces, about 100,000, that “could have had any of their environment variables decrypted.” It calls that figure an upper bound, not a confirmed count.
Who refunds stolen AI API key charges?
This is the part no announcement leads with. Railway’s report lists each AI provider’s response to customers whose keys were used. Here is that list as Railway published it on November 10, with what each provider’s own contract says.
| Provider | Response to Railway customers (Nov. 10) | What the contract says |
|---|---|---|
| AWS Bedrock | Refunding under its existing fraud policy | Section 2.1: customer responsible for all account activity, authorized or not |
| Google Gemini | Refunding under its existing fraud policy | Gemini API terms hand billing and disputes to Google Cloud’s terms |
| OpenAI | Open a support case; refunds reviewed case by case | Section 3.2: customer responsible for all activities under its account |
| SpaceXSI | Claims go through Railway support; case by case | Not reviewed for this article |
| Anthropic | Talks ongoing; Railway covering costs meanwhile | Section D.5: customer responsible for all activity under its account |
| OpenRouter | Enforcing its no-refund policy; Railway covering | No-refund policy in its terms, per Railway |
Read the two columns together and the pattern is plain. The contracts all point the same way. The AWS Customer Agreement makes the customer responsible for account activity “regardless of whether the activities are authorized by you.” The OpenAI Services Agreement, effective January 1, 2026, says in section 3.2 that the customer “is responsible for all activities that occur under its Account.” Anthropic’s Commercial Terms say the same in section D.5, and section H.1 adds that the customer “is responsible for fees incurred by its account.” Google’s Gemini API terms do not address stolen keys at all; they send billing and payment disputes to Google Cloud’s own terms.
None of the four sets of terms we read contains a refund promise for stolen keys. So when AWS and Google refund, they are applying a fraud policy that sits outside the contract, and when OpenAI reviews “case by case,” that is the contract working as written. The difference between getting your money back and not is policy, and policy can change between one breach and the next.
Railway’s own position changed in two weeks
The other surprise is who ended up paying. On October 26, Railway’s update said it was “unable to refund customers for spend performed with compromised API keys” and told customers to go to their AI providers directly. By November 10 the position had reversed. For any provider that will not cover the losses, Railway now says “we will be covering all token losses in lieu of them.”
That is a hosting company paying for a breach it did not have to pay for under any contract we have seen, and it deserves credit. It also shows how thin the ground is. The Hacker News reported that the claim form Railway asks customers to fill in still says the company is not responsible for usage of the keys, and that it names no cap or deadline. A promise in a blog post is not a term in your contract, and the next platform to be breached may not make one.
It was not just Railway
Railway was one of at least nine AI developer and hosting platforms that disclosed incidents in October, according to security firm Wiz, which named the month “Black October.” Its list runs from Fireworks AI on October 6 to Northflank on October 30, with more added in its updates through November 10. Wiz says there is no single vulnerability linking the attacks. The common thread is the target: stored settings, with a focus on the ones that grant AI access.
Wiz’s two worked cases show how fast a stolen key turns into money. Both keys, taken in vendor breaches, made their first unauthorized call within 30 minutes of the theft. One then made about 800,000 calls to AWS Bedrock in thirty hours. That is roughly 26,700 calls an hour, or about seven every second, around the clock. The other made about 1.7 million calls in thirteen hours, roughly 36 a second. Wiz estimates those two keys alone likely ran up over $100,000 at list price.
That is the arithmetic that should change how you think about the $740,000 total. Spread across up to 100,000 workspaces, it sounds like a few dollars each. It was not spread evenly. A key that gets picked up by a reseller can run up a five or six figure bill on its own before anyone opens an invoice, and a monthly billing email arrives far too late to help.
What does this mean for a small business that never touched Railway?
Picture a five-person plumbing company with a booking assistant on its website. A freelancer built it, hosts it on a platform like Railway, and pasted the company’s OpenAI key into the app’s settings. The owner has never logged in to that hosting account and may not know it exists. If that platform is breached, the contract makes the plumbing company responsible for whatever the thief spends, and its refund depends on the policy OpenAI applies that month.
None of this is a reason to stop using AI tools. It is a reason to know where your keys live, the same way you know who has a key to the shop. We covered the first line of defense, the spend cap, in our earlier piece on stolen AI API keys: the default monthly ceilings on each provider’s page ran from $250 to $5,000 when we checked. This breach adds a second lesson. A cap limits the damage; it does not decide who pays for what got through.
Four questions to ask whoever built your AI tools
You do not need to understand environment variables to ask these. You need the answers in writing.
1. Where is our AI key stored, and on whose account? If the answer is “in my hosting account,” you are relying on that company’s security and on the freelancer’s account staying in good shape. Ask whether the key can sit in a platform account your business owns.
2. Is there one key per app, with a spending limit on each? One key shared across your website chatbot, your quoting tool and a test project means one theft takes all three down, and one bill mixes them together. Separate keys make a stolen one easy to spot and easy to cut off without stopping everything else.
3. Who gets the usage alert, and how fast? Wiz’s keys were in use within 30 minutes. An alert that goes to a freelancer’s old email address is no alert. Make sure the owner, or someone the owner trusts, receives provider spending alerts directly.
4. If our host is breached, what is the order of operations? The Cloud Security Alliance published a note on November 11 on exactly this question. Its advice: rotate the key directly with the AI provider, because filing a charge report with the platform does not revoke the key; review provider usage logs back to early October; file the reimbursement claim promptly and keep the case ID; confirm in writing whether you must pay disputed charges while the claim is reviewed; switch off prepaid auto-reload while claims are open; and tell your cyber insurer now rather than later.
If you are not sure whether your business uses Railway or another affected platform, that is the first question to put to your developer this week. Railway told all users to rotate their keys even though its analysis points to a subset, and Railway’s earlier lesson about depending on one host is in our comparison of Railway and AWS.
The good news inside the bad news
Two things went right here, and both are worth noticing. Railway published a detailed timeline, named every provider’s position, and ended up covering losses it had first refused. And two of the largest providers treated stolen-key spending as fraud and started refunds. Those are the standards worth expecting from every company that holds your keys.
The work for an owner is small: know where the key lives, cap it, get the alert, and keep the provider’s support page bookmarked. That is about an hour with your developer, and it turns a five-figure surprise into a short phone call.
Frequently Asked Questions
Who pays when a stolen AI API key is used?
Under the OpenAI, Anthropic and AWS terms we read on November 11, 2026, the account holder is responsible for all activity on the account, and AWS says so whether or not the activity was authorized. Refunds happen when a provider chooses to apply a fraud policy, which AWS and Google did for Railway customers while OpenAI reviews claims case by case.
Did Railway refund customers for stolen AI key charges?
Railway first said on October 26 that it could not refund spending on compromised keys. Its November 10 incident report says it will cover token losses for any provider that will not refund them, and that it is already covering Anthropic and OpenRouter costs while those are resolved.
How fast can a stolen AI key run up a bill?
In two cases Wiz documented, stolen keys were first used within 30 minutes. One made about 800,000 calls in thirty hours and the other about 1.7 million in thirteen hours, and Wiz estimates the two together likely passed $100,000 at list price.
What should I do first if my host reports a breach?
Rotate the AI key directly with the provider that issued it, since a claim filed with the hosting platform does not revoke it. Then check the provider’s usage logs, file a refund claim and keep the case ID, turn off prepaid auto-reload, and notify your cyber insurer.
Does anyone on your team actually know where your AI keys are stored today, and who would get the alert if one started spending at three in the morning?
