Security Startup Finds Admin Access to Baseten's GitHub in 25 Minutes

An unauthenticated attacker who found Baseten's public container registry could have pulled a GitHub token with admin rights to the AI inference company's main product repository, its deployment pipeline and several customer-specific private repositories, without needing any credentials of its own to start looking. Security firm Strix says it did exactly that, in 25 minutes, while evaluating Baseten as a possible vendor.

Strix published the findings in a blog post on Sept. 1, after Baseten fixed the issue over the summer. Baseten is an AI inference platform that Strix's own post values at $13 billion. Baseten's security team confirmed the exposure as critical and rotated the token by the afternoon of July 14, according to Strix.

What the token could reach

Strix's scanning agent enumerated baseten.co subdomains and found a Harbor container registry at gcp-us-east4-zlw.registry.baseten.co with a public project. Without logging in, it could list repositories, pull anonymous tokens and download image manifests directly. One image, baseten/baseten-app, carried a GitHub personal access token belonging to the account basetenbot in its Docker build history.

The token dated to a build from March 3, 2023, and Strix says it still worked in July 2026, more than three years later. It granted admin and push access to Baseten's main product repository, admin access to its GitOps deployment repository, admin access to its Homebrew tap, and read and write access to additional private repositories, including some specific to individual customers.

Repository	Access the token granted
Product repository	Admin, push
GitOps deployment repo	Admin
Homebrew tap	Admin
Customer-specific private repos	Read, write

How a 2023 build argument survived to 2026

The root cause is a known Docker pattern: the token was passed as a build argument to fetch private dependencies during the image build, and Docker recorded the expanded value permanently in the image's history metadata rather than discarding it once the build finished. Anyone who could pull the image could read that history.

Strix co-founder Alex Schapiro described the moment the agent surfaced a credential that actually authenticated with a single word in the write-up: 'VOILA.' The technology outlet Techzine Global reported the same finding independently, describing Strix as a prospective customer evaluating Baseten's service rather than a paid security engagement.

The timeline

• July 13, 11:10 p.m.: Strix reports the exposed token to Baseten.
• July 14, morning: Baseten makes the Harbor project private.
• July 14, 4:34 p.m.: Baseten confirms the finding as critical and rotates the token.
• July 14, 5:05 p.m.: Baseten confirms deletion; Strix submits additional findings from the same scan.
• July 17: The remaining findings are closed.
• Sept. 1: Strix publishes the disclosure publicly, roughly six weeks later.

Strix said Baseten's security team was quick to respond and sent thank-you merchandise, but neither side has described a formal bug bounty payment. No CVE has been assigned to the exposure, and Baseten has not said publicly whether it audited its other public container images for similarly stale credentials, or how long the Harbor project had been reachable before Strix found it. GitHub's own infrastructure logged five separate outages in August 2026, unrelated to this incident but a reminder that the platform underpinning most software supply chains keeps producing its own headlines. The Terminal has previously covered a case of an AI company's access to a code registry going undisclosed for months, a similar gap between when an access problem is found internally and when the public is told, seen this time from the defender's side rather than the attacker's.