Attackers Are Now Going Straight for the Secrets Behind Your AI Tools

This week’s biggest security story for anyone using AI tools wasn’t about an AI model doing something wrong. It was about attackers going after the infrastructure underneath AI tools — the API keys and credentials that let your software talk to them — on purpose.

Railway’s Breach Was Aimed at AI Infrastructure, Not Just Data

On October 21, 2026, the cloud deployment platform Railway disclosed that an unauthorized party had accessed the system storing customers’ environment variables — and for some accounts, got the decrypted contents, not just the encrypted blobs. Environment variables are exactly where developers store API keys, database credentials, and private registry credentials, because that’s what they’re built for.

What makes this one different from a routine breach: Railway said it believes this is part of a wider campaign targeting platform companies specifically to compromise AI inference providers — in other words, the attackers weren’t just after data in general, they were after the credentials that control access to AI services. Railway paused deployments during its investigation and is telling every user to rotate every secret stored on the platform, whether or not they’ve been told they’re confirmed affected.

If your team — or any developer, vendor, or agency you work with — has API keys for OpenAI, Anthropic, or any other AI provider sitting in an environment variable on a platform like this, this is the kind of breach that turns into “someone else is running up your AI bill, or worse, pulling data through your own credentials” months after the initial headline fades.

The PHP Vulnerability That Underpins More of the Web Than You’d Guess

The same week, PHP’s maintainers disclosed two critical remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619), rated as high as 10.0 in severity, affecting versions 5 through 8. PHP powers a huge share of the CMSs, e-commerce platforms, and custom web tools businesses run on — including, often, the landing pages, forms, and backend glue that feed leads into a CRM. Patches shipped October 21; PHP’s own core developer said there’s no real workaround besides patching. If your website or marketing stack runs on PHP anywhere in the chain (WordPress, many e-commerce platforms, and plenty of custom backends do), this is worth confirming with whoever manages hosting, this week rather than next.

AI Agents Are Already Running Attacks, Not Just Getting Attacked

Zoom out from this week specifically: in early October, a hacker used an open-source agentic penetration-testing tool (ARTEX AI) alongside Claude agents, running on multiple LLMs, to breach six South Korean financial institutions — Shinhan Bank, KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, and Hyundai Capital. Customer names, phone numbers, income and loan data, and in some cases national ID numbers were exposed. South Korea’s government held an emergency meeting afterward.

Put together, this week’s stories point at the same shift from two directions: attackers are stealing the credentials that control AI access (Railway), and attackers are using AI agents to run the attacks themselves (the bank breaches). Your AI tools aren’t a side concern in your security posture anymore — they’re the target and the weapon, depending on which end you’re standing on.

What This Means for Your Team This Week

• Rotate any API keys or credentials stored on a platform like Railway, Vercel, or similar — even if you haven’t been told you’re affected. Treat “we believe impact may be limited” as “we don’t know yet,” not “you’re fine.”
• Ask whoever manages your website and forms whether PHP is patched. If marketing or sales runs any PHP-based tool — a landing page builder, a lead form, a CMS plugin — this is a direct question to ask this week, not a general “stay safe online” reminder.
• Treat your own AI agents’ credentials the same way you’d treat Railway’s exposure. If an agent holds an API key, scope what that key can actually do, and know how fast you could rotate it if you had to.
• Assume an attacker could be running an AI agent against you, not just a person. The South Korean bank case shows agentic attacks aren’t theoretical anymore — they’re a live tool in a real intrusion.

Checklist

• [ ] Rotated or confirmed the status of any API keys and credentials stored on Railway or similar deployment platforms
• [ ] Confirmed with IT or your dev team whether PHP is patched anywhere in your marketing or sales stack
• [ ] Reviewed what each AI agent’s API key or credential can actually access, not just whether it works
• [ ] Have a rotation plan ready for any AI provider key, so “we need to rotate this now” isn’t a scramble

About GPTify: GPTify.co helps sales and marketing teams put AI to work with practical, no-fluff workflows. We publish a weekly newsletter, AI Insights for Sales & Marketing, and maintain GTMShelf, a directory of AI tools for sales and marketing teams.