Railway is not currently under attack.

Recent API key revocations by AI providers are precautionary actions in response to the October 21 incident, not a new security incident.

On October 23, after the attacker’s access had been fully removed on October 22 at 03:32 UTC, AI providers requested another batch of potentially affected keys. We provided that batch to OpenAI and Anthropic, but because we could not filter keys by when they were added, it inadvertently included newer keys. As a result, providers may have revoked replacement keys you created after the incident. These revocations do not indicate that your replacement keys were compromised.

You should also receive communications directly from the providers taking action, explaining their response and any steps you need to take.

If a provider revoked your key, create a replacement, update the corresponding Railway environment variable, and redeploy the services that use it. If your keys are still working, this notice does not require you to repeat completed rotations. We’re sorry for the confusion and additional disruption.