We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
- Anonymous pull access to public Harbor project exposed baseten/baseten-app image and config
- GitHub PAT for basetenbot hidden in Docker build history since March 2023, still valid
- Token had admin/push on main product, GitOps, and Homebrew repos plus customer repos
- Baseten confirmed critical severity and rotated token within one day
From the original article
8 min read at strix.ai
We were about to trust Baseten with our own and our customers’ data. So to be safe, we ran Strix to ensure they were secure first. About 25 minutes later, it had a live GitHub token with repository-level admin rights on internal Baseten repos.
By bearsyankees · strix.ai
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.