What Happened to My Gemini Key After the Railway Breach

On 21 October, 2026 at 13:07 UTC, someone who wasn't me sent a request to my Gemini API key: Say hi.

The same day, Railway disclosed that an unauthorized third party may have accessed customer environment variables, some of them decrypted, "with the aim of compromising AI inference providers." My key was in the environment variables of two personal projects I ran on Railway. Only the keys I had on Railway were affected.

This isn't a post about blame. My projects got hit, and Google AI Studio's logs show exactly what happens to a key once it's stolen.

I downloaded every logged request on the project and separated my traffic from everyone else's. Every request before 21 October was mine. Then:

21 Oct 13:07 UTC gemini-3.1-pro-preview "Say hi" 21 Oct 16:43 UTC gemini-4-argon "You just need to reply Hi." 21 Oct 17:25 UTC gemini-4-argon "You just need to reply Hi." 22 Oct 14:24 UTC gemini-3.1-pro-preview "Say hi" 22 Oct 14:53 UTC gemini-4-argon "You just need to reply Hi." (3 times in 2 minutes) 23 Oct 11:48 UTC gemini-3.1-pro-preview "Say hi" 23 Oct 11:57 UTC first real job; 277 requests on 9 models by 12:48 Enter fullscreen mode Exit fullscreen mode For two days, the key was only tested On 21 and 22 October, nothing ran on the key except these test prompts. They asked for no real work; they only checked that the key answered, on two of Google's top models.

Nine minutes after the last test, the first real job arrived. In the next 51 minutes there were 277 requests across 9 models, up to 24 a minute.

The first hour of jobs was a sample of what followed. In all, the logs recorded 1,154 requests that weren't mine: at least 563 different prompts on 15 models, at up to 93 a minute. 57% were in Chinese, 399 carried images and 97 carried audio.

Most went to Gemini 3.7 Flash (330) and 3.8 Flash (274), then Gemini 3.1 Pro (121) and Gemini 4 Argon (119).

That many unrelated jobs on one key at once looks like a key resale service, not a single attacker.

Many jobs came in batches: the same system prompt, repeated for each item. These are the most common, with what each job was doing. Chinese prompts are shown with a translation.

Translating fiction into Bulgarian (98 requests). The samples I read were fiction dialogue, with placeholder tags the model had to keep.

【目标语言 / Target language】保加利亚语 = Bulgarian (bg) # 你是一个翻译专家 Target language: Bulgarian. You are a translation expert.

A role-play engine (39). Interactive fan fiction; the sample I read featured video game characters.

I am Director, a Daydream Realization Engine... Current status: Dream Weaving Mode activated

Checking text-to-speech output (31). The model transcribes generated speech so it can be compared with the script.

Here is a script and the audio a text-to-speech system produced from it.

Judging AI answers (25). Two anonymous answers, A and B, graded against a rubric.

你是回答质量裁判。根据待评任务 Q 和下面的评审标准，分别审核匿名候选 A、B You are an answer-quality judge. Review anonymous candidates A and B against the task Q and the criteria below.

Labelling voices (24). Each clip is described by gender, pitch, speed, volume and age, then checked against a given description.

你是具有丰富声学知识的专家。请根据以下维度描述一段语音 You are an expert with rich acoustic knowledge. Describe a voice clip along the following dimensions.

Splitting videos into scenes (22). Thumbnails from one video, grouped into scenes by background.

The images are thumbnails cut from one video and arranged in time order

Building image-editing training data (15). For each photo, the model writes an edit instruction of type add, delete or replace.

本次请生成【添加】类型的编辑任务。请对上面这张图像完成标注任务。 Generate an edit task of type "add". Annotate the image above.

Logging sound events (12). A timestamped list of every sound in a clip, apart from speech.

You are an AI Acoustic Event Logger. Your task is to identify all sound events, excluding discernible dialogue

Marking Chinese exam answers (6). Scoring students' written answers against the question and a marking guide.

你是语文阅卷教师。对输入的待批改题空评分 You are a Chinese-language exam marker. Score the answers submitted for marking.

Matching places (6). Deciding whether a TripAdvisor attraction and a record from another source are the same place.

你是一个 POI（地点）实体匹配专家。 You are a POI (place) entity-matching expert.

There were also one-off jobs, such as an Android phone-automation agent working through an expenses app:

You are the Evaluator-Worker in a Planner-(Evaluator-Worker) Android automation loop.

Not all of it was harmless. One role-play bot used a "no refusals" prompt, written to get around the model's safety rules.

Taken together, most of this looks like AI data work: labelling, grading and translating data in bulk, on someone else's bill.

The two days of test prompts are the warning. A key rotated in that window is worthless to whoever took it.

If you've seen similar system prompts in your own logs, please share them in the comments. Comparing them may help others spot a stolen key sooner.

Expand Alex Shev Alex Shev Alex Shev Follow Creator of Terminal Skills — curated terminal skills, CLI tools, and practical workflows for modern developers. Location Dallas-Fort Worth, Texas Work Founder at SEOG & Terminal Skills Joined Mar 7, 2026 • Oct 30 Dropdown menu Copy link Hide The post-incident timeline is often more useful than the headline. I’d distinguish exposure, confirmed use, revocation, and downstream remediation, then automate the shortest safe path from detection to rotation. A key is not fully remediated until dependent deployments and local environments stop accepting the old credential too.