Strix, an open-source autonomous pentest agent, found a live GitHub admin token for Baseten in 25 minutes

Strix, an open-source autonomous pentest agent released by security company OmniSecure, was pointed at *.baseten.co with no credentials and no source code. It came back in 25 minutes with a live GitHub personal access token that had admin and push rights to Baseten's main product repository, its GitOps repository, its Homebrew tap, and read and write access to several private repositories including one containing per-customer directories. Alex Schapiro of Strix disclosed the finding on 1 September 2026, and the post reached the top of Hacker News on 15 September.

What the agent did on its own

Strix started with reconnaissance: it enumerated hosts and certificate logs and found a Harbor registry at gcp-us-east4-zlw.registry.baseten.co. One Harbor project was public. Without any credential, Strix could list repositories, get anonymous pull tokens, and download image manifests and blobs, including an image called baseten/baseten-app.

Rather than stop and report an exposed registry, Strix pulled the image, ran TruffleHog against the layers, and inspected the image config directly. It found a GitHub token sitting in the history[].created_by field of a build step, part of a RUN command from a Dockerfile that had expanded ${GITHUB_TOKEN} into the recorded step. The build step ran on 3 March 2023. The token was still valid in July 2026 when Strix tested it against GitHub.

The agent then made a read-only GET /user call, which returned account basetenbot, followed by a scope check that returned X-OAuth-Scopes: repo and organisation membership in basetenlabs. Strix wrote up the finding and stopped. It did not clone any private customer repository, push any change, or read customer data.

Where the fault sat

The token got into the image through a familiar shape. A build needed to fetch private dependencies from GitHub and passed the token in as a Docker build argument, then wrote it into the global Git config with git config --global. Docker records build arguments in the image's config history, and that config is downloadable with the image. Docker's own documentation warns about this.

The fix Strix recommends is a BuildKit secret mount rather than a build argument, plus a build-time authentication that does not persist the credential into Git's configuration file. Any old image that already contains the credential has to be considered leaked, and the token has to be revoked. Rewriting the Dockerfile without rotating the token protects nothing.

Baseten's security team confirmed the finding as critical, made the Harbor project private, and rotated the token by the afternoon of the disclosure day. Strix credits Baseten for a professional response.

What the story tells a team building software

Strix is available on GitHub under usestrix/strix. The point of the disclosure is that a scan that took an agent 25 minutes and no seed data is the same shape of scan an attacker can run against any public container registry. A team that publishes images anywhere reachable should audit both the layers and the build history of every published tag with docker history --no-trunc, check what its build credentials are actually scoped to, and give them an expiry. Fetching a private dependency needs read access to that one dependency, not admin on the product repository.

An autonomous pentest agent that stops when it has evidence and does not touch customer data is a workflow this AI News section watches for. Strix's own writeup shows the reasoning at each step, which is worth reading for a team building its own agent tooling: recon, hypothesis, cheap read-only tests, and a stop condition when the finding is confirmed.

Source

We wanted to use Baseten for inference. We ended up with admin access to Baseten GitHub repos, Alex Schapiro, Strix, 1 September 2026. Repository: usestrix/strix.