Security firm Strix said its autonomous hacking agent gained admin access to Baseten's production GitHub in about 25 minutes, after finding a leaked token in a public Docker image.
Strix builds an AI agent that automates penetration testing, and published the disclosure this month. Testing it against Baseten, a machine learning inference platform, the agent worked with no hints about where to look, found that Baseten's Harbor container registry was publicly accessible, downloaded a product image, and extracted a personal access token from the image's Docker build history, Strix said.
The token dated to March 2023, when someone passed it as a build argument to fetch private dependencies, and still had admin and push access when Strix found it in July 2026. That access covered Baseten's main product repository, the GitOps repository controlling its infrastructure, its Homebrew tap and several private, customer-specific repositories, according to the disclosure.
Strix reported the issue July 13. Baseten's security team confirmed it as critical the next day and said they had made the Harbor project private and rotated the token, Strix said. The researchers said they stopped at confirming access, without cloning any customer repository or altering configuration, and Baseten closed out lower-severity findings from the same engagement by July 17 before Strix published the writeup in September.
The story is as much about the researcher as the bug. An agent given no instructions beyond testing the company found a three-year-old credential that had outlived every reason for existing. For any team that bakes a token into a Docker build argument and moves on, the practical lesson is that forgetting about it no longer means it stays hidden. An autonomous agent can find it, and so can whoever runs one against you first.