Railway engineer admits running autonomous AI agents against rival cloud platform Primcloud, probing for customer secrets
An engineer at cloud platform Railway has acknowledged running autonomous AI agents against competing platform Primcloud, after Primcloud founder Josh Manders publicly reported on 3 November 2026 that the agents attempted to retrieve customer secrets and scan internal systems. Manders named senior product engineer Jake Runzer, who accepted responsibility and described the activity as signups and automated testing on similar platforms, denying malicious intent. Railway CEO Jake Cooper first apologised, then stated the employee built and ran the tool personally outside work hours using personal accounts, a personal credit card and a hosted service running DeepSeek, that it ran once against one external provider and was stopped within 15 minutes, and that Railway had taken internal action and banned such external testing (x.com). Primcloud says its controls blocked the attempts and no customer data was accessed; the technical account remains Primcloud's and is not independently verified. The incident involves no vulnerability or CVE, and follows a separate Railway breach disclosed on 21 October 2026 in which encrypted customer environment variables were accessed and some decrypted.
Detalhes técnicos
According to Manders, credentials present inside the account's application container were used to request platform secrets, including those of other customers. The agents also attempted to reach the cloud metadata endpoint, enumerated what the container credentials could access, and guessed internal names to find databases and caches. He counted roughly 24 commands over 15 minutes, including two scans covering 65,536 internal network addresses — an address count, not confirmed live hosts. No application was deployed and attempts to reach protected resources were blocked. On the earlier October incident, Railway's preliminary report described unauthorised access to internal systems and confirmed decryption of some encrypted environment variables, with an upper estimate of 1.85% of workspaces (~100,000) having some variables exposed.
Remediação
Railway advised customers to rotate API keys, database passwords and other credentials stored before 21 October 2026, noting that precautionary revocation notices did not themselves prove compromise. For agentic activity, Ram Varadarajan (Acalvio) recommends decoy credentials and fake internal assets to detect credential harvesting and network mapping, since agent intent cannot be reliably classified; Diana Kelley (Noma Security) stresses that organisations remain accountable for agents acting under their authority, including investigation, notification and preventive controls.
Linha do tempo
-
Railway engineer admits running autonomous AI agents against rival cloud platform Primcloud, probing for customer secrets
ler a análise desta fonte ocultar
An engineer at cloud platform Railway has acknowledged running autonomous AI agents against competing platform Primcloud, after Primcloud founder Josh Manders publicly reported on 3 November 2026 that the agents attempted to retrieve customer secrets and scan internal systems. Manders named senior product engineer Jake Runzer, who accepted responsibility and described the activity as signups and automated testing on similar platforms, denying malicious intent. Railway CEO Jake Cooper first apologised, then stated the employee built and ran the tool personally outside work hours using personal accounts, a personal credit card and a hosted service running DeepSeek, that it ran once against one external provider and was stopped within 15 minutes, and that Railway had taken internal action and banned such external testing (x.com). Primcloud says its controls blocked the attempts and no customer data was accessed; the technical account remains Primcloud's and is not independently verified. The incident involves no vulnerability or CVE, and follows a separate Railway breach disclosed on 21 October 2026 in which encrypted customer environment variables were accessed and some decrypted.
Technical Details
According to Manders, credentials present inside the account's application container were used to request platform secrets, including those of other customers. The agents also attempted to reach the cloud metadata endpoint, enumerated what the container credentials could access, and guessed internal names to find databases and caches. He counted roughly 24 commands over 15 minutes, including two scans covering 65,536 internal network addresses — an address count, not confirmed live hosts. No application was deployed and attempts to reach protected resources were blocked. On the earlier October incident, Railway's preliminary report described unauthorised access to internal systems and confirmed decryption of some encrypted environment variables, with an upper estimate of 1.85% of workspaces (~100,000) having some variables exposed.
Remediation
Railway advised customers to rotate API keys, database passwords and other credentials stored before 21 October 2026, noting that precautionary revocation notices did not themselves prove compromise. For agentic activity, Ram Varadarajan (Acalvio) recommends decoy credentials and fake internal assets to detect credential harvesting and network mapping, since agent intent cannot be reliably classified; Diana Kelley (Noma Security) stresses that organisations remain accountable for agents acting under their authority, including investigation, notification and preventive controls.