We got admin access to Baseten's production GitHub

8.5 relevance

Security breach writeup revealing GitHub PAT token admin access to production, highly actionable for security and platform engineers.

AI/ML strix.ai

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For a Solutions Architect focused on cloud infrastructure and security, this shows that even billion-dollar AI infrastructure companies can have critical credential exposure through misconfigured container registries, underscoring the need for regular black-box scanning and registry access controls in your own deployments.

Key Takeaways

Integrate automated registry scanning and credential detection into your CI/CD pipeline, and restrict Harbor project visibility to prevent anonymous pull access.

We wanted to use Baseten for inference. We ended up with admin access to Baseten GitHub repos - Strix

Summary

Strix's autonomous hacking agent discovered a live GitHub personal access token with admin and push access to Baseten's production repositories, including their main product repo and GitOps infrastructure, by scanning a publicly accessible Harbor container registry. The token, dating from March 2023 and still active in July 2026, was found without any credentials by enumerating subdomains and pulling anonymous image layers. Baseten's security team rotated the token within a day of disclosure, but the incident demonstrates how exposed container registries can leak critical infrastructure credentials.

Author

Alex Schapiro