A Railway engineer’s AI agents reached into a rival cloud
The engineer said a testing harness went off the rails; Railway’s CEO responded by banning external automated testing.
An AI-agent testing harness run by a Railway engineer crossed into a rival cloud provider’s infrastructure, prompting Railway to ban external automated testing.
Primcloud founder Josh Manders publicly accused Railway employee Jake Runzer of trying to breach the company’s systems. Runzer confirmed that the activity came from him. He said he had been running agents for signups and agentic testing on similar platforms, with no malicious intent, but halted the harness after it was “going off the rails and reaching too far.”
Railway CEO Jake Cooper said there was no authorized reason for the activity and that the company would officially prohibit automated testing against external systems.
Primcloud says the agents used credentials available inside a container to request customer secrets, queried a metadata endpoint and scanned ports over roughly 15 minutes. Those technical details come from Primcloud’s account; Manders says the attempts were blocked and no breach occurred.
The incident is a concrete example of how a harness built for a benign task can expand beyond its intended scope. For companies deploying agents, the lesson is operational: external targets need explicit allowlists, restrictive credentials, network controls and clear human approval boundaries, because intent alone does not constrain an autonomous system.
