Fake Signups, Real Costs

Railway's servers were compromised, and every customer is rotating keys

Railway posted "an urgent notice from the Railway team", and its founder, Jake, wrote that they were alerted of malicious activity that compromised Railway's servers. The status account says Railway is rotating all bucket credentials, has invalidated all Railway API tokens, and paused builds, which means customers can't redeploy to pick up new secrets until builds come back. One affected developer replied that a leaked API key got them billed a few hundred dollars before they noticed. That is their claim, not Railway's.

900 signups for a free credits challenge, and many of them were the same people

1,000 free credits per new join, down from the early-bird offer

Wandura AI ran a film challenge with free credits. Over 900 creators joined, and the team says it saw many duplicate accounts claiming free credits. It ended the early-bird credits, removed the duplicates it found, and now automatically freezes free credits on accounts its fraud detection flags, which also disqualifies them from prizes.

4,565 "GPTBot" requests, and 4,334 of them wanted the .env file

4,334 of 4,565

Richard Lemon checked 15 days of logs to see who reads the site's llms.txt. It got 31 requests, two from an AI agent, none from GPTBot or ClaudeBot. Of the 4,565 requests claiming to be GPTBot, 4,334 weren't OpenAI. They were looking for the .env file. A user agent string is a costume, not an ID.

Zero new users in 25 days, and the crawlers still ate the free tier

Akshay runs a directory site and says it had zero new users in the last 25 days, existing users made only about 20% of the requests, and the rest came from AI crawlers. Every request was unique, so none of it could be served from cache, and it exhausted the Neon database free tier.