Railway 遭入侵要求所有用户轮换密钥，波及模型 API 凭据
用 Railway 的朋友注意了，赶紧去轮换 API key，平台自己都把部署全冻了。OpenCode 上周也中招，这波专偷模型 key。
开发者平台 Railway 遭入侵，攻击者解密了部分存储的环境变量，其中包含数据库密码、云服务密钥和模型 API key。Railway 称只有部分用户受影响，但仍冻结了全部部署，并主动重置了存储桶密钥和 GitHub token。Railway 将此次入侵与针对 AI 推理服务商平台的连环攻击联系起来，要求相关服务商撤销泄露的 key。几天前 OpenCode 也披露一次蒸馏攻击，可能导致 1.4% Console 用户的 OpenAI、Anthropic 和 Google key 暴露。这类攻击中，被盗 key 会被用来批量获取前沿模型回答，用于训练竞争模型，费用由受害者承担。
Developer platform Railway told every customer to rotate all secrets after an intruder decrypted some stored credentials.
Those environment variables hold database passwords, cloud keys and model API keys, letting anyone holding them sign in as the owner.
Railway said a subset of users may be affected, yet it froze all deployments and reset bucket keys and GitHub tokens itself.
It tied the intrusion to a string of attacks on platforms aimed at AI inference providers, and asked those providers to revoke keys.
Days earlier, OpenCode blamed a distillation attack for a breach possibly exposing OpenAI, Anthropic and Google keys saved by 1.4% of Console users.
Stolen keys let attackers harvest frontier-model answers for training rival models while victims pay the bills.
