Railway paused every build after it thinks AI API keys may have been decrypted
AspireAI · Railway
On October 21, 2026, Railway disclosed that it detected anomalous activity in the systems that store customer environment variables, and that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Environment variables are where deployed apps keep their secrets, and for AI builders the high-value ones are model provider API keys — OpenAI, Anthropic, Google and the rest — alongside database passwords and private registry credentials. The part that makes this more than a routine hosting breach is Railway's own framing: it believes this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers, and it has notified those upstream providers to revoke all keys proactively. That points at credential theft aimed at paid inference access rather than ordinary server access. Railway paused all deployments while it investigates, which has a second-order effect — you cannot roll out replacement secrets until builds resume. The company says its initial analysis suggests impact may be limited to a subset of users, but has published no count of affected accounts, has not named the attacker and has not explained how access was gained. Its guidance is blunt: immediately roll all environment variables, including API keys and private registry credentials stored in Railway, and review logs for those services for unusual activity.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.