Guide
Compromised AI API keys: What your team should do
Railway estimates $740,000 in unauthorised spending. Learn how to revoke exposed AI API keys, investigate costs and restore affected services safely.
AI-generated illustration. The chart is illustrative.
When someone steals an AI API key, their requests can show up on your bill. Revoke the affected key with the provider. Then identify which applications used it, what it authorised and how much spending occurred during the period in question. Put replacement keys into an environment once you have regained control of access to it.
Cloud hosting provider Railway estimates that unauthorised spending reached about $740,000. Its case shows why platform engineering, security and finance need to work from the same incident record.
What Railway's report confirms
Railway published its detailed report on 10 November 2026, following the attack on 20 and 21 October. The attacker decrypted some customer variables. The affected data included linked-account tokens for 1,852 users, including bring-your-own AI keys and GitHub OAuth tokens. Railway reset the affected tokens and notified the users. The estimated $740,000 represents unauthorised use of stolen keys. Railway is working with providers on refunds. Railway incident report
Railway asked several providers to revoke potentially exposed credentials while it secured its infrastructure. At that point, it could not ensure that replacement keys stored on Railway would remain protected. Customers therefore faced two decisions. How do we stop unauthorised use? And when can we restart our application with a new key?
What should you do if an API key is compromised?
- Revoke the key with the provider that issued it. Act promptly when you have a credible reason to suspect exposure. Removing it from your application configuration leaves it valid with the provider. If the scope is unclear, review other credentials held in the same affected environment. Anthropic recommends immediate revocation if you suspect compromise. Anthropic Help Center
- Establish which systems and charges are affected. Preserve available usage and billing records. Record the time window, project and key ID where the provider exposes one. Identify which applications and jobs use the key and what its permissions allowed. Record the identifier in your incident ticket and leave the secret value in your secrets manager.
- Restore services in a controlled way. Once you have secured the affected environment, issue new credentials scoped to their purpose. Update the applications and background jobs you identified. Verify that they run with the new credentials, that the old ones are revoked and that usage has returned to normal. For an incident at a hosting provider, coordinate recovery with that provider.
Who does what during the incident?
| Team | What it handles |
|---|---|
| Platform engineering | Revoke access, identify dependent services and verify recovery |
| Finance | Break down spending by project and time period, and dispute charges with the provider |
| Security | Assess impact, preserve evidence and coordinate any necessary reporting with the relevant teams |
Name one person to coordinate the response. When finance spots another anomaly, the platform team needs the same project ID and time window. When platform engineering revokes a key, record the time in the incident timeline. Otherwise, it becomes difficult to tell whether a new charge reflects ongoing use or delayed billing.
How can you reduce the impact of the next incident?
Assign each credential to an application and an owner. Record the provider, project, key reference, purpose and owner. Keep the secret values in your secrets manager. Use separate credentials for different applications and environments, and limit them to the functions required where the provider supports it. Google Cloud guidance
Check what happens when you exceed your budget. Does it send an email or stop usage? A Google Cloud budget sends alerts and does not cap spending by itself. Check whether the AI service you use supports an enforced limit. Decide who responds to the alert and who can pause a service if needed. Google Cloud guidance on budget alerts
Practise replacing a key on a test integration you control. Can you access the provider account? Do you know every application or job that uses the key? Can you see whether legitimate jobs work again after the switch? Our guide to API keys and sensitive data in logs explains how to keep secrets out of the records you create along the way.
Document the incident and follow-up actions
Start with five questions. Which credential is affected? When was it revoked? What do we know about usage and costs? Which services are back? Who owns the unresolved work? Kopexa Incident Management helps you record decisions and evidence for the incident and track the actions that follow.