Railway’s AI agents go off the track on a rival’s network

Summary

Railway senior product engineer Jake Runzer ran AI agents for signups and agentic testing against Primcloud's infrastructure, according to Primcloud founder Josh Manders. Manders says the agents tried to obtain credentials, request platform secrets, access cloud-provider metadata, and scan all 65,536 addresses on Primcloud's internal network twice over 24 scripted commands in 15 minutes. Primcloud says its defenses blocked every attempt and that nothing was accessed.

Topics

• AI agents

Related items

• InfoOpenAI Says New GPT-6 Cyber Model Hunts Flaws Without Crossing the LineSimilar attack · SecurityWeek
• MediumMalicious Browser Extensions Could Use Claude Dispatch to Run Code on Users' ComputersSimilar attack · The Hacker News
• MediumOpenAI Model Wrote Its Own Network Code to Get Around Sandbox RestrictionsSimilar attack · SecurityWeek
• MediumChainalysis Breach Exposes All Users' Credentials, Forces Shutdown of Key ServicesSimilar attack · The Hacker News
• MediumThreat actors use agentic AI tooling to find and abuse exposed secretsSimilar attack · Microsoft Security Blog