{"id":16923,"date":"2026-11-06T11:41:07","date_gmt":"2026-11-06T11:41:07","guid":{"rendered":"https:\/\/newestek.com\/?p=16923"},"modified":"2026-11-06T11:41:07","modified_gmt":"2026-11-06T11:41:07","slug":"railways-ai-agents-go-off-the-track-on-a-rivals-network","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16923","title":{"rendered":"Railway\u2019s AI agents go off the track on a rival\u2019s network"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

AI agents operated by cloud infrastructure and application hosting platform, Railway, have attempted to access a rival platform\u2019s infrastructure, prompting the cloud provider\u2019s leadership to acknowledge the incident on social media.<\/p>\n

Railway senior product engineer Jake Runzer acknowledged running agents to perform signups and agentic testing on similar platforms after Primcloud founder Josh Manders publicly questioned why Railway employees were attempting to breach his infrastructure.<\/p>\n

Runzer said<\/a> he had halted the testing harness after it began reaching too far. Railway co-founder and CEO Jake Cooper apologized, saying the models were \u201cgetting a bit too good at this point,\u201d and pledged to prohibit non-manual external testing.<\/p>\n

According to Manders<\/a>, the agents attempted to receive credentials from an application container, request platform secrets, access cloud-provider metadata, discover internal databases and caches, and scan all 65,536 addresses on Primcloud\u2019s internal network twice.<\/p>\n

The activity reportedly involved 24 scripted commands over 15 minutes.<\/p>\n

\u201cAn agent can act without a person directing every step,\u201d said Diana Kelley<\/a>, chief information security officer at Noma Security. \u201cIt doesn\u2019t remove the responsibility of the people and organizations that deploy it.\u201d<\/p>\n

Primcloud said its defenses blocked every attempt and that \u201cnothing\u201d was accessed. The incident follows Railway\u2019s own security disclosure<\/a> involving encrypted customer environment variables.<\/p>\n

<\/a>The engineer was acting on his own<\/h2>\n

Cooper said<\/a> the employee had developed the testing tool independently, using personal accounts, a personal credit card, and his own time. He added that Runzer ran it against a single external provider and halted it proactively within 15 minutes, adding that Railway had addressed the incident internally.<\/p>\n

\u201cI can confirm they ran this tool once and only once,\u201d Cooper said in an X post. \u201cRailway does not condone these actions. We expect all our employees to uphold our standards of conduct, whether acting on behalf of Railway or in a personal capacity.\u201d<\/p>\n

Although that timeline checks out with Manders\u2019 own account, some details remain murky. After publicly calling out Runzer on X, Manders posted a follow-up, saying he had observed another attempt to access the account after his initial warning.<\/p>\n

\u201cI see you tried to access the account after this tweet too, Jake,\u201d he had written more than 30 minutes after his first post.<\/p>\n

Primcloud does not have a bug bounty program, according to its Acceptable Use Policy (AUP<\/a>). It forbids unauthorized probing, scanning, or vulnerability testing without prior written consent.<\/p>\n

<\/a>\u2018The AI did it\u2019 is not an accountability strategy<\/h2>\n

Experts condemn Railway\u2019s \u201crogue AI\u201d explanation for the incident.<\/p>\n

Amir Boldo<\/a>, co-founder and chief product and technology officer of Above Security, cautioned against describing agents as attackers, as they can execute attacker-like sequences without any malicious intent<\/a>.<\/p>\n

Execution traces can establish what an agent<\/a> did, but they cannot independently prove intent, he said, adding that investigators need evidence spanning instructions, identities, permissions, inputs and tool calls.\u00a0 \u201cYou can\u2019t put an agent on trial. You can hold each party accountable for its part,\u201d Boldo said.<\/p>\n

Ronald Lewis<\/a>, head of cybersecurity governance at Black Duck, argued that users may not fully appreciate that delegating work to an agent also delegates the authority associated with their identity.<\/p>\n

\u201cWe now have to ask what happens when trusted identity is delegated to a non-deterministic system capable of independently deciding how to use it,\u201d Lewis said. Cooper confirmed in his X post that Railway had addressed the incident internally and was reinforcing its expectations for employee conduct, including when employees act in a personal capacity.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

AI agents operated by cloud infrastructure and application hosting platform, Railway, have attempted to access a rival platform\u2019s infrastructure, prompting the cloud provider\u2019s leadership to acknowledge the incident on social media. Railway senior product engineer Jake Runzer acknowledged running agents to perform signups and agentic testing on similar platforms after Primcloud founder Josh Manders publicly questioned why Railway employees were attempting to breach his infrastructure…. <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16923","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16923"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16923\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}