The Railway Breach and AI RPGs: What Happened, Which Games Said They Ran on It, and What Players Should Do (2026)

The Railway breach was a security incident at a hosting company in October 2026, in which an unauthorized party accessed encrypted secret settings of some of Railway’s customers, and decrypted some of them. Four AI RPGs we cover said they ran on it: RPBuddy, Craft, Friends & Fables and Isentroth. This page is for players. It explains what Railway says happened, why games were a target, what the four games said, and what you can sensibly do.

What this page is, and is not. We are not a security firm and we have not seen any game’s logs. Everything about the breach comes from Railway’s own posts, read on 4 November 2026: its disclosure of 21 October, its changelog of 23 October and its preliminary report of 22 October. What each game said comes from its own announcement. We do not know if your account or your stories were affected, and no public notice we read says they were.

Disclosure: Craft and RPBuddy have given us free access for our reviews. Friends & Fables and Isentroth have given us nothing. None of that changes what is written here.

The Short Version

Question	Answer
What happened?	An unauthorized party accessed encrypted environment variables of some Railway customers, and decrypted some of them
When?	Railway’s monitoring first flagged abnormal activity on 20 October, and it published its disclosure on 21 October 2026
How big?	Railway says at most about 1.85% of workspaces had variables potentially compromised
Was player data taken?	No notice we read says so. Railway’s posts are about its customers’ keys
Who was the target?	Railway says the attacker appears to have been after AI provider keys and platform keys
What should I do?	See the checklist below. The key step is for anyone who gave a game their own AI key

What Railway Says Happened

Railway is a service developers rent to run their apps without owning servers. Many small AI RPGs run on a service like it, because a small team can then focus on the game.

According to Railway’s own account:

20 October. Its monitoring paged engineers about abnormal latency, and Railway later identified an attempted privilege escalation by an outside party. It halted its build pipelines that evening.
21 October. Forensics found that the attacker could pull encrypted secrets and had obtained credentials to Railway’s build environment. Railway found unauthorized queries of encrypted environment variables, and said a subset was decrypted. It published its security disclosure and told customers to roll their keys.
22 October. Railway said the attacker no longer had access to its internal systems, and restored its builds and API in stages.
26 October. Existing customers’ services were fully restored, and new sign-ups stayed paused.

What was accessed. Parts of Railway’s internal systems, including its build setup and credentials, and encrypted environment variables, some of which were decrypted. Railway says the variables may include secrets such as API keys and database or registry credentials.

What it says was not accessed. Its preliminary report says individual accounts were not logged into and that customers’ running apps stayed online throughout. It says it has not ruled out access to source code and will say more in its final report. It does not say whether customers’ databases were accessed, and it recommends customers remove public network access to theirs.

What it told customers to do. Roll every environment variable, including API keys, and any private registry credentials. Review logs for unusual activity. Review GitHub audit logs and registry logs. Redeploy the latest commit, reconnect GitHub and recreate command line and CI credentials. And contact AI token providers directly about fraudulent spend, because Railway says it cannot refund it.

The 21 October disclosure also says deployments were paused while Railway investigated, so customers could not roll out new versions until builds were restored. That detail turned out to matter for games, as the next section shows.

Why AI RPGs Were a Target

An AI game master has to call an AI model, and that costs money. The key that lets it do so is a secret the game keeps on its host. Railway’s disclosure says it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers, and it says it notified those upstream providers so they could revoke keys. Its report says the attacker appeared to be seeking AI provider keys.

For a player, the useful reading is this: the first thing at risk is the game’s own bill, not your story. A stolen key can be used to run up charges on the developer’s account. That is bad for a small studio and can show up as an outage, a price change or a paused feature. It is a reason to care about how a game handles a bad day, which is something our data-custody audit looks at.

What the Four Games Said

These come from each game’s own notice, summarised in our news digest of 3 November.

RPBuddy said its AI chat and some generation features were unavailable, and that Railway’s own deploy system was blocking its fix. It was back on 22 October.
Craft and Friends & Fables posted the same notice. Each said it had rotated all credentials as a precaution and run a full security audit, and found no evidence of any of its user data being accessed.
Isentroth, a Norse text RPG we have written up as a first look, treated every secret on the host as read after about twenty hours without a restore time, and moved the whole game to Google Cloud behind Cloudflare the next morning. Its developer wrote it up in our Community Library as Leaving a breached host in one morning. Isentroth’s own announcement did not name Railway. The Library entry does. Players’ saves live on their own machines, so the move did not touch them.

A game saying it found no evidence is not proof that nothing happened, and it is not proof that something did. It is what the developer knew at the time. We have not audited any of them.

What to Do as a Player

This is general good practice, not advice from a security expert, and it is not specific to any one game.

Read the game’s own notice. It will say if anything is asked of you. If it tells you to change a password or log in again, do it.
If you gave a game your own AI key, replace it. Some games let you paste in a key from OpenRouter, Anthropic, Google or another provider so the game uses your account. A key stored on an affected host is one of the things Railway says may have been read. Make a new key at the provider, so the old one stops working, and look at the provider’s usage page for spend you do not recognise. Railway’s own report tells customers to take unusual spend to their AI provider.
Set a spending limit on any key you give a game. Where a provider allows it, a cap turns a worst case from a large bill into a small one. Worldtable’s docs, for example, recommend a spending limit on any key a builder adds to a world.
Do not reuse one password across games. If you used the same password on a game and on other sites, change it on the other sites. Nothing we read says passwords were taken.
Keep your own copy of what you care about. Character sheets, world notes, the best chapters of a campaign. A game on a host that pauses for a day is unavailable for a day, and a game that cannot recover can be gone. Use an export button where there is one. Our guide to moving a campaign covers the options.
Be careful with messages that mention the breach. An email or direct message saying your game account is at risk, with a link to fix it, is how scams ride on a real incident. Go to the game’s own site or its official server instead.

What We Cannot Tell You

Whether your account, stories or payment details were exposed on any game. Railway’s posts cover its customers, and the four games’ notices say they found no evidence.
Whether other AI RPGs ran on Railway and said nothing. We checked the games we cover through their announcements, and the list above is the ones that said so.
What Railway’s final report will find. It said one would follow, and it has not ruled out source code access.
How any game stored a player’s own key. Do not assume a game encrypts it. Ask, or avoid giving a key you cannot afford to lose.

What Good Looks Like in a Game’s Notice

Reading the four notices side by side, the useful ones did three things: said what happened in plain words, said what the player had to do (even if the answer was nothing), and said when service would be back. A game that cannot tell you where your story lives, or what it asks of you on a bad day, is a game to be careful with.

Frequently Asked Questions

What happened in the Railway breach? Railway, a company that hosts apps for developers, said an unauthorized party accessed encrypted environment variables belonging to some of its customers, and decrypted some of them. Its disclosure is dated 21 October 2026. Environment variables are secret settings a game uses to run, such as keys for AI services and databases.

Were my stories or account details stolen? We cannot tell you, and no public notice we read says. Railway’s reports are about its customers’ keys, not about the players of those customers’ games. Craft and Friends and Fables each said they found no evidence of user data being accessed. Whether your data was in play depends on what a particular game kept on that host.

Which AI RPGs were on Railway? RPBuddy, Craft, Friends and Fables and Isentroth each said so, in their own notices or in a runbook in our Community Library. Others may have used it without saying so, and we have not checked every platform. Check a game’s own announcements for its notice.

What should I do if I gave a game my own AI key? Replace that key at the AI provider, so the old one stops working, and look at the provider’s usage page for spend you do not recognise. Railway’s own report advises customers to contact their AI providers about fraudulent spend. Where a provider allows it, set a spending limit on any key you give a game.

Should I change my password? Only if the game tells you to, or if you used the same password on that game and on another site. Nothing we read says passwords were taken. Using a different password for each service is sensible whenever a company you rely on has an incident.

How can I protect my stories from a game going offline? Keep your own copy of anything you care about: character sheets, world notes and your best chapters. A game on a host that is paused for a day can be unavailable for a day, and one that fails for longer can be gone. Where a game has an export button, use it.