Blog Details

As the Strix team, we were evaluating Baseten as a secure inference platform for our own and our customers' data. Valued at $13 billion and heavily relied upon by serious enterprises, the platform appeared technically flawless. However, as a security company, our standard procedure is to scan third parties before handing over any data, models, or code. Therefore, we pointed Strix at Baseten's subdomains and let it run without any credentials or source code. Just 25 minutes later, the agent returned with a live GitHub Personal Access Token (PAT) that had full administrative access to Baseten's internal repositories.

This token was not limited to simple read access; it provided admin and push rights to Baseten's main product repository, the GitOps repo driving their clusters, and their Homebrew tap. It also granted read/write access to specific private repositories per customer. The shocking detail was that the image dated back to March 2023, yet the token was still active and functional when found in July 2026. We must give credit to Baseten's security team; they confirmed the issue as critical, locked down the registry project, and rotated the token by the next afternoon. This speed and professionalism are rare positive developments in the industry.

Strix began, like any good pentest, with reconnaissance. The most severe vulnerabilities in infrastructure are often hidden in services on forgotten subdomains. This is why we always recommend black-box testing alongside code-access testing. Strix enumerated hosts, reviewed certificate logs, and mapped the full attack surface. Eventually, it found a Harbor registry at gcp-us-east4-zlw.registry.baseten.co. Harbor stores container images and groups repositories into projects. One of these projects was public, allowing Strix to list repositories, obtain anonymous pull tokens, and download image manifests without any token or authentication.

At this point, many security teams would simply report an 'exposed registry' and move on. However, companies intentionally publish images, and Strix avoids false positives. The real question was the actual impact of these exposed images. Strix decided to pull the image to see what was inside. The agent's own analysis indicated that to prove this was a real exposure and not just metadata noise, it needed to verify every step of the chain. The goal was to extract concrete evidence from the pulled image, such as proprietary code, internal binaries, hardcoded credentials, or internal hostnames.

The first promising hit was a pair of AWS keys in the baseten/baseten-app image. Strix made a read-only sts:GetCallerIdentity call to determine which account the credentials belonged to. The response was InvalidClientTokenId. That key was dead, but Strix kept looking. It pulled the layers, ran TruffleHog, and inspected the image config directly. And there it was: a classic GitHub personal access token sitting in the history[].created_by field. Although we are not Docker runtime experts, Strix knew that this field records how a build step was created, and in this case, it contained a RUN command, allowing us to pinpoint the token's origin clearly.

This case clearly highlights one of the biggest blind spots in modern cloud architectures: hidden credentials in old container images. Many developers embed tokens used temporarily in CI/CD pipelines into image layers, and these images can remain in registries for years. Baseten's situation, where the token remained active since 2023, shows that routine security scans often fail to catch such 'embedded' secrets. Strix's autonomous agent found this detail, which the human eye might miss, through systematic reconnaissance and deep image analysis. This is proof that the entire sector needs to be more careful with credential management in DevOps processes, not just one company.

Security does not end with strengthening perimeter walls; it requires continuous auditing at every point of data flow, especially on paths leading to production environments. Baseten's rapid response played a pivotal role in preventing a potential disaster. However, the main lesson is that such vulnerabilities can be caught not by manual testing, but by autonomous and continuously running security agents. Tools like Strix help minimize the cost and impact of data breaches by allowing companies to test their own infrastructure and supply chains before taking risks. This incident serves as a reminder of the dynamic nature of cloud security and the importance of proactive defense.