55
55
Mythos Changed the Math on Vulnerability Discovery. Most Teams Aren't Ready for the Remediation Side
55
55
30
55
60
55
35
55
55
30
60
55
42
60
30
55
30
55
42
30
55
55
30
55
55
55
55
30
35
30
55
30
We got admin access to Baseten's production GitHub in 25 minutes
Strix autonomous hacking agent extracted a working GitHub token with repo admin rights from Baseten's public Harbor image; Baseten rotated it next day.
Strix, an autonomous hacking agent, scanned *.baseten.co without credentials and found a public Harbor container registry project anonymously exposing the baseten/baseten-app image. A GitHub personal access token for basetenbot, embedded in Docker build history since March 2023, still worked in July 2026 and granted admin/push rights to basetenlabs/baseten, flux-cd, and homebrew-tap plus read/write on private customer repos. Baseten, valued at $13 billion, confirmed the issue as critical and rotated the token within a day.
58
55
55
55
55
30