An AI Agent Found a Live Admin Key in 25 Minutes: The Baseten Token, Explained

What happened

Strix, a security company, was shopping for an AI inference provider and landed on Baseten. Before buying, it pointed its own AI security agent at Baseten’s public web surface, with no special access and no inside help. Within 25 minutes, Strix says, the agent surfaced a live GitHub token with admin rights. The token belonged to a bot account and had been sitting inside a public Docker image on Baseten’s Harbor container registry since a 2023 build.

How the agent got there

The chain was ordinary, which is the point. The agent found a container registry that allowed anonymous pulls, pulled an image, and read the personal access token baked into it. No exploit was written by a person. Strix co-founder Alex Schapiro said the token carried admin and push rights on Baseten’s product repository, the GitOps repository that drives its clusters, and its Homebrew tap. In plain terms, a key that could change what Baseten ships and what its infrastructure runs, exposed for about three years.

What it was not

This was not a breach. Strix disclosed the finding, and reports that Baseten has a responsive security team and already uses AI security tooling of its own. There is no claim of stolen data or damage. The story is that an autonomous agent, given nothing but a domain, did in under half an hour what a human pentester might spend days on, and that the weak spot was a forgotten credential rather than clever code.

Why it matters for the stack

Old secrets do not expire on their own. Tokens end up in build artifacts, container layers, and registries that were never meant to be public, and they keep working until someone rotates them. AI agents make finding those leftovers cheap, for defenders and for attackers. If you run infrastructure, assume an agent is already reading your public images, and rotate anything that predates that assumption.

Sources: Strix’s disclosure post, which is the only primary account. Baseten’s own statement, if published, was not part of this check.