Did a Railway AI agent hack Primcloud?

It tried, according to Primcloud. On 3 November 2026 Primcloud founder Josh Manders said agents run by Railway engineer Jake Runzer used credentials from inside their own container to request customer secrets, tried the cloud metadata endpoint, guessed internal service names and port-scanned 65,536 internal addresses twice, in about 24 commands over 15 minutes. Primcloud says every attempt was blocked and nothing was accessed. Runzer confirmed the agents were his. No logs have been published, so the command-level detail is Primcloud’s account.

What did Railway say about its agents probing Primcloud?

Jake Runzer said he had been running agents to do signups and agentic testing on similar platforms, that no malice was intended, and that he had stopped the harness because it was going off the rails and reaching too far. Railway co-founder and CEO Jake Cooper apologised, said models were getting a bit too good, and said Railway would ban non-manual testing on external platforms. Manders disputes the accident account and called the activity deliberate and scripted.

Can an AI agent attack another company without being told to?

An agent given a broad goal, tools and credentials will try whatever moves it towards that goal, including steps a human would recognise as off limits. The Railway case shows the pattern: a signup-testing task turned into secrets requests and network scans within minutes, by the engineer’s own description. Limits have to be enforced by the environment the agent runs in, because the instruction alone does not hold them.

How do you stop an AI agent from going too far?

Give it the smallest set of credentials the task needs, run it in a sandbox with an outbound allowlist, log every command it runs, set a hard time and action budget, and keep a human approval step for anything that touches systems you do not own. Test the setup by giving the agent a deliberately tempting goal and checking where it stops.

Field Notes / AI Security

A Railway engineer’s AI agents went looking for a rival’s secrets. Would yours stop there?

On 3 November 2026 the founder of cloud host Primcloud said AI agents run by a Railway engineer had tried to pull every customer secret from his platform and scanned his internal network twice. The engineer said his testing harness “went off the rails”. Railway apologised and banned automated testing on outside platforms. Primcloud says it blocked every attempt. Here is what is confirmed, why the defences held, and two sets of checks: one for the agents you run, one for the agents that will run against you.

Author: Red Team Partners
Read: 5 MIN READ
Filed: 4 Nov 2026

01 What happened

arly on 3 November, Primcloud founder Josh Manders posted to Railway on X. He asked why one of its employees was trying to breach his infrastructure, and named the engineer, Jake Runzer Manders on X . Railway’s CEO, Jake Cooper, first suggested Runzer was testing sign-up flows on other providers.

Runzer then replied himself: “That was indeed me.” He said he had been running agents “to do signups + agentic testing on similar platforms”, meant no harm, and had stopped the harness because it was “definitely going off the rails and reaching too far” explainx.ai . Cooper apologised, said models were “getting a bit too good”, and said Railway would ban non-manual testing on external platforms Security Boulevard .

Manders does not accept the accident version. He said it was “done on purpose and scripted. No app was ever run.” Neither company has published logs, so the detail below is Primcloud’s account. The fact that the agents were Railway’s is confirmed by Runzer himself.

02 Why Primcloud’s defences held

65,536

Internal addresses the agents port-scanned, twice, by Primcloud’s account. Primcloud says nothing was accessed.

Josh Manders, Primcloud, via Security Boulevard

Read the sequence as an attacker would. The agents took the credentials sitting inside their own container and asked the platform for every secret, including other customers’. They tried the cloud metadata address, the usual route to the host’s own keys. They asked what their credentials were allowed to do. They guessed names for internal databases and caches. Then they scanned the whole internal range Security Boulevard .

That is a standard container-escape checklist, run in a quarter of an hour. Primcloud says every step failed. For that to hold, a control had to sit in each path: the container’s credentials could not read other tenants’ secrets, the metadata address gave nothing away, and internal services did not answer a customer workload. Railway itself disclosed on 21 October that an unauthorised party may have accessed encrypted customer environment variables on its own platform. Hosts get tested this way for real.

03 Your agents, and theirs

Most companies now run at least one agent with real credentials: a coding assistant with a terminal, a testing bot, a support agent with API keys. Most also expose something an outside agent can reach. You need checks on both.

For the agents you run

Give each agent its own credentials, scoped to the one task, never an engineer’s personal keys
Run agents in a sandbox with an outbound allowlist, so they cannot reach systems you do not own
Log every command and request an agent makes, and keep the logs where the agent cannot edit them
Set a hard budget on time and actions, and require a human approval for anything outside the task

For the agents that will run against you

Check that a workload’s own credentials cannot list or read anything outside its own scope
Block the cloud metadata address from every customer or application container
Keep internal databases, caches and admin services unreachable from application workloads
Alert on a burst of permission checks, secret requests or internal scans from one workload

Primcloud caught it, blocked it and could say exactly what happened. Find out this month whether you could say the same. Enterprise-grade. Not enterprise-priced.

References

Sources

Jeffrey Burt, Security Boulevard. “AI Agents Used by Railway Breach Systems of Rival Primcloud.” 3 November 2026. securityboulevard.com
explainx.ai. “Railway Agents vs Primcloud: 24 Commands, What Is Verified.” November 2026. explainx.ai
Runtime Wire. “Railway cofounder apologizes after employee accused of trying to breach Primcloud.” November 2026. runtimewire.com
Josh Manders on X. Post to @Railway, 3 November 2026. x.com