AI news, 12 Nov 2026: Stolen AI keys run up a $740,000 bill
Railway says keys stolen in its October breach ran up about $740,000 of AI usage, and DeepMind used AI agents to formally verify Signal's core crypto code.
Cloud platform Railway published its report on an October breach in which attackers went looking for AI provider keys and, by Railway's estimate, ran up about $740,000 of unauthorised AI usage. Google DeepMind showed AI agents formally verifying the core cryptographic code behind Signal, New York opened registration for frontier AI developers, and Anthropic gave enterprise admins finer control over what Claude's connectors can do.
Stolen AI keys from a cloud platform breach cost about $740,000
Railway's incident report, published on 10 November, sets out how an attacker escaped build isolation on 20 October, picked up internal credentials, and on 21 October used a decryption credential to read encrypted customer variables. Railway says the attacker queried variables by name and was "specifically prioritizing AI provider keys". Variables from at most about 100,000 workspaces (1.85%) could have been decrypted, linked-account tokens for 1,852 users were reset, and estimated unauthorised spend on the stolen keys is about $740,000. BleepingComputer reports that Railway will cover charges that providers decline to refund.
The lesson reaches well beyond one platform. An AI key is now a payment instrument: whoever holds it can spend your money in minutes. Railway's fixes are a good checklist for anyone: short-lived, narrowly scoped credentials, central audit logs on every encrypt and decrypt, and each service able to decrypt only the secrets it needs.
What I would do first: find every AI key stored in a CI, build or hosting platform, rotate it, and split shared keys so each service has its own.
DeepMind's agents formally verify Signal's core crypto code
Google DeepMind said on 10 November that its AlphaProof Code framework, with agents running on Gemini Carbon, wrote machine-checked Lean proofs that Signal's core cryptographic code delivers the protections human experts specified, checked down to the code that runs on devices. Humans chose what to prove and reviewed every specification; the agents flagged about 1% of the codebase for a human second look. The work took four weeks. As a test, the team reintroduced two previously fixed bugs into an isolated copy, and the system proved those versions insecure.
For most companies this is a research result, not a tool you can buy today, and DeepMind's post does not say whether AlphaProof Code will be released. But it points to where code review is heading: AI writes the proofs, and people spend their time on the specification.
New York opens RAISE Act registration for frontier AI developers
New York's Governor announced on 10 November that large frontier AI developers must register through the new RAISE Portal by 1 January 2027. The state's DIGIT office, under the Department of Financial Services, oversees them. The same announcement launched the New York Center for AI Responsibility and Research at Binghamton University, with more than 80 researchers, to independently test frontier AI systems and help review developers' published safety frameworks.
These duties fall on model makers, not on Indian companies using their APIs. Still, the announcement notes a 72-hour window for reporting critical safety incidents, and that kind of timeline tends to flow down into vendor contracts. This is not legal advice.
Anthropic adds Sheets, Claude Data and admin controls for connectors
Anthropic's 10 November update adds Claude Sheets, Whiteboards and Claude Data (formerly Dashboards), which connects to sources such as Snowflake and Salesforce. Partners can now embed their apps in Claude as interactive connectors.
The governance details matter more for a CTO. Enterprise admins can decide who uses which products and connectors and limit what each connector does, for example reading Slack without sending messages. Security teams get audit logs and a Compliance API. If your staff already use Claude, review connector permissions before people switch these on.
How CloudOEngine helps
Two of today's items come down to secrets and control over what AI is allowed to do. CloudOEngine includes governance as standard: tenant isolation, role-based access, audit logs and per-tenant encrypted secrets. Agents in the AI runtime run real tools, and every step and tool call is traced and inspectable. With Autopilot, a person approves an action, in the app or through an email approve link, before it runs. None of this replaces rotating your keys this week, but it keeps AI access under one permission model and one audit trail.
Frequently asked questions
How were AI keys stolen in the Railway incident?
Railway's report says the attacker escaped build isolation, moved through internal systems and used a decryption credential to read customer environment variables, specifically prioritising AI provider keys. Railway estimates about $740,000 of unauthorised spend on the stolen keys.
Who has to register under New York's RAISE Act?
The Governor's announcement says large frontier AI developers must register through the new RAISE Portal by 1 January 2027. Companies that only use AI models are not the target, and this is not legal advice.
What should we do this week about AI provider keys?
List every place an AI provider key is stored, rotate any key that lives in a build or deploy platform, and set up alerts with each provider for unusual usage. Then give each service its own key so one leak does not expose everything.
Sources
- Incident report: October security incident (Railway)
- Railway breach leads to $740,000 in fraudulent AI charges (BleepingComputer)
- Formal verification of Signal's protocol with AlphaProof Code (Google DeepMind)
- Governor Hochul declares NY will lead the nation in AI science and safety (New York State)
- More ways to work with Claude: Sheets, Whiteboards and interactive connectors (Anthropic)