Autonomous hacking agent obtained admin access to Baseten's production GitHub in 25 minutes

What happened

Security company Strix has disclosed that its autonomous hacking agent, pointed at Baseten's public infrastructure with no credentials and no source code, obtained a live GitHub token with admin rights over the inference platform's core repositories in roughly 25 minutes.

According to a Strix blog post that reached the Hacker News front page, the firm was evaluating Baseten — which Strix describes as a $13 billion company that many businesses rely on for inference — as a provider for its own workloads. Because Strix scans vendors before trusting them with code and data, it set the agent loose on Baseten's subdomains. The outcome was a working token for the basetenbot account, embedded in a container image anyone could download anonymously.

How the agent found it

Per Strix's account, the agent began with reconnaissance, enumerating hosts and certificate logs until it located a Harbor container registry on a baseten.co subdomain. One Harbor project was set to public, so the agent could list repositories, mint anonymous pull tokens and fetch image manifests and blobs without authentication.

Rather than stopping once it had found an exposed registry, Strix says, the agent pulled an image named baseten/baseten-app to gauge actual impact. An AWS key found inside was already dead, but running TruffleHog and reading the image configuration turned up a GitHub personal access token in the Docker build history — in the field that records how each build step was created, where a GITHUB_TOKEN build argument had been expanded into a RUN command verbatim.

A single read-only request to GitHub's API confirmed the token was live and belonged to basetenbot.

What the token could reach

GitHub reported that the token carried the repo scope and that the account sat inside the basetenlabs organization. Using only read-only requests, the agent mapped the permissions:

• Admin and push access to the main product repository behind the inference platform
• Admin and push access to the GitOps repository holding the desired state that Baseten's clusters apply
• Admin and push access to the Homebrew tap that distributes Baseten's CLI
• Read and write access to several private repositories, including one with a top-level customers directory of per-customer subdirectories

Strix considers the GitOps access especially serious, since holding that credential would allow someone to modify the desired state driving the clusters — turning a build secret into production infrastructure changes. The Homebrew tap, meanwhile, opens a supply-chain route to anyone installing Baseten's tooling. The build step that leaked the token was timestamped March 3, 2023, and the credential still worked when tested in July 2026.

The Strix team says it went no further — no cloning, no pushes, no configuration changes — and sent a disclosure email immediately.

How the leak happened

The root cause, according to Strix, is a familiar Docker pitfall: a build needed to fetch private dependencies from GitHub, so a token was passed in as a build argument. Docker records build arguments in image metadata and history, and warns about exactly this behavior. Deleting a credentials file from the filesystem does nothing about the copy preserved in the build history, which travels with every pull of the image. The same step also ran a global git config command that writes the authenticated URL into Git's configuration file, creating a second copy of the secret.

Baseten's response

Strix credits Baseten's security team with classifying the issue as critical, locking down the registry project and rotating the token by the following afternoon, describing them as fast and professional to deal with.

Why it matters

Two things lift this beyond a routine leaked-secret report. First, the blast radius: a single token inside a publicly downloadable image granted control over a production platform's source code, its infrastructure state, its CLI distribution channel and customer-specific repositories. Build histories are an easily overlooked leak vector, and as this case shows, tokens buried there can remain valid for years.

Second, the finder was an AI agent working unaided from reconnaissance through extraction, validation and permission mapping in 25 minutes. The same automation that makes vendor vetting cheap also makes finding these flaws cheap for actors with less friendly goals. Treating build arguments as secrets, and scanning the artifacts that CI systems publish, is now baseline hygiene rather than an optional extra.