TagTeam

I was hosting projects on Railway, and on October 21 they disclosed a breach. An unauthorized third party may have accessed encrypted customer environment variables and, for some, obtained the decrypted contents. Those variables can hold API keys, database credentials and registry credentials. Railway paused deployments and told everyone to rotate their secrets, and now I’m migrating all my data off it.

What stuck with me was who the attackers were after. Railway said it believes this was part of a series of attacks on platform companies aimed at compromising AI inference providers. And once the keys were out, money moved fast. According to Taylor Monahan, around $371,000 flowed out across more than 500 transactions from over 200 addresses on at least 19 blockchains.

It’s not a one-off. About 70% of websites with a known server language run on PHP, and over a third of those are still on PHP 7 or older, which doesn’t get security fixes anymore (W3Techs). Attackers don’t need anything clever. They look for the oldest, weakest part of a system and keep at it until it breaks.

AI agents are now starting to shop and pay for people over rails like Coinbase’s x402, and that creates two new problems. A malicious agent can attack a store, and a hacked store page can trick an honest agent into overspending. Existing fraud tools check whether the person paying is the real cardholder. But an agent really is the holder of its credential, and it pays faster than any person could.

So we asked a different question: who is the human responsible for this agent, and did they actually ask for this payment? And since attackers go after the weakest spot, we wanted a defense that finds its own weak spots before they do.