The Pulse
Strix Says Its AI Agent Found Baseten’s GitHub Admin Token in 25 Minutes
Strix says its autonomous security agent found a live Baseten GitHub personal access token inside a publicly downloadable Docker image. The token had admin and push access to Baseten’s product, GitOps, and Homebrew repositories before the c
AI.info Team ·
Strix says its autonomous security agent needed about 25 minutes to find a live GitHub personal access token with administrator rights inside Baseten’s publicly downloadable Docker image. Baseten’s security team then classified the issue as critical, restricted the exposed registry project, and rotated the token by the next afternoon, according to Strix’s disclosure published September 1.
“About 25 minutes later, it had a live GitHub token with repository-level admin rights on internal Baseten repos,” Alex Schapiro wrote in the company’s account of the test. Strix had been evaluating Baseten as an inference provider and scanned *.baseten.co without credentials or source-code access.
A public Harbor project exposed more than image metadata
The scan began with reconnaissance across Baseten’s internet-facing infrastructure. Strix says it found a Harbor container registry at gcp-us-east4-zlw.registry.baseten.co, where one project was configured as public.
The agent could list repositories without authenticating, obtain anonymous pull tokens, and download image manifests and blobs. One of the available images was baseten/baseten-app. Strix did not treat the registry’s exposure alone as proof of a serious vulnerability; it pulled the image to determine whether its contents created a larger risk.
The first credential it found was a pair of AWS keys. A read-only identity check returned InvalidClientTokenId, showing that those keys were no longer usable. Strix continued examining the image layers and configuration rather than stopping at the dead credential.
The live credential sat in Docker build history
Strix says it found a second credential while running TruffleHog and inspecting the image configuration directly. The token appeared in the history[].created_by field, where Docker recorded a build command containing the expanded value of GITHUB_TOKEN.
That distinction matters because Docker images include configuration and build-history data in addition to their filesystem layers. Removing a credential from a file does not remove another copy recorded in the image’s build metadata. Docker’s documentation warns that build arguments and environment variables are inappropriate for secrets because they can persist in the final image, and recommends temporary secret or SSH mounts instead.
Strix tested the credential with a read-only GitHub GET /user request. GitHub returned a successful response identifying the account as basetenbot. Strix says the image build step that exposed the token dated to March 3, 2023, while the credential remained active when the company found it in July 2026.
One token reached product, deployment and developer repositories
The token’s scope was not limited to downloading a private dependency. Strix says GitHub returned the repo OAuth scope and associated the account with the basetenlabs organization.
Read-only permission checks showed administrator and push access to Baseten’s main product repository, the GitOps repository used to drive its clusters, and the Homebrew tap used to distribute its command-line tooling. Strix also found read/write access to several private repositories, including repositories associated with customers.
That combination created several distinct risks. A person holding the token could potentially alter product source code, change the desired state of infrastructure managed through GitOps, or tamper with the channel used to distribute Baseten’s developer tools. Strix says it did not clone the customer repository, push code, or modify configuration after confirming the permissions.
Baseten restricted the registry and rotated the token
Strix’s disclosure timeline places the initial report at 11:10 p.m. on July 13, 2026. Baseten made the Harbor project private the following morning, but Strix told the company that the GitHub token still worked.
At 4:34 p.m. on July 14, a person identified by Strix as Anton from Baseten Security confirmed the issue as critical, said the project had been made private, and confirmed that the token had been rotated. Baseten also asked Strix to securely delete the images it had downloaded. Strix confirmed deletion at 5:05 p.m. and sent two lower-severity findings from the same scan. The company says Baseten closed those remaining findings on July 17.
Strix notified Baseten in September that it planned to publish the finding and sent the company a draft. The disclosure describes Baseten’s security team as responsive and says the company sent shirts and sweatshirts as thanks for reporting the issue.
Why old image history still needs inspection
The technical failure began with a familiar build pattern: a GitHub token was passed as a Docker build argument so a build step could retrieve private dependencies. Strix says the command also configured Git with an authenticated URL, creating a second way for the credential to persist inside the image.
Docker’s recommended alternative is a BuildKit secret mount, which exposes a token only for the duration of a build instruction. Teams still need to check that commands consuming the secret do not write it into a file, Git configuration, image layer, or build-history entry.
Strix recommends checking anonymous access to old registry projects and tags, inspecting images with docker history --no-trunc, reviewing configuration blobs and layers, and testing what build credentials can actually access. It also recommends limiting tokens to the smallest required permission set and assigning them an expiration date.
The finding did not come from a targeted hunt for Baseten’s GitHub credentials. Strix says its agent discovered an overlooked registry, verified that anonymous image pulls worked, rejected one dead credential, followed the image’s build history to another credential, and checked the second token’s repository permissions autonomously. The exposed Harbor project and GitHub token were closed before Strix published the account on September 1, 2026.