AI pentest agent found a live admin GitHub token in Baseten's public image

Security firm Strix scanned AI infrastructure vendor Baseten before trusting it with data, pointing its autonomous hacking agent at *.baseten.co with no credentials or source access. Within about 25 minutes the agent surfaced an active GitHub personal access token for the basetenbot account — carrying admin and push rights to Baseten’s main product repo, the GitOps repo driving its clusters, and its Homebrew tap, plus read/write access to private per-customer repositories. The token came from a build dated March 2023 and was still valid when discovered in July 2026, more than three years later.

The agent reached it through ordinary recon: enumerating hosts and certificate logs led to a Harbor container registry with a publicly readable project. From there it anonymously pulled the baseten/baseten-app image, dismissed a set of dead AWS keys, and ran TruffleHog across the layers. The live token wasn’t in the filesystem at all — it sat in the image config’s build history (history[].created_by), where a RUN step had expanded GITHUB_TOKEN directly into the recorded command. This is the classic failure mode of passing a credential as a Docker build argument: scrubbing the file does nothing when the build metadata still ships a copy, and it persists in any already-downloaded image regardless of Dockerfile fixes.

The episode doubles as a demonstration of AI-driven offensive tooling, which chained recon, validation, and credential testing autonomously without hints. The remediation is well understood — use BuildKit secret mounts for temporary auth, inspect both layers and build history, and actually revoke stale tokens rather than assuming a config change is enough. Baseten’s security team came off well, confirming the issue as critical, locking down the registry, and rotating the token by the next afternoon. The broader takeaway for anyone running containers with GitHub access: old images are an easily forgotten place for long-lived secrets to leak.