1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T1648,

A security vendor evaluating Baseten as an inference provider pointed an autonomous scanning agent at the company's domains, with no credentials and no source code, and had a working GitHub token with admin rights on internal repositories about 25 minutes later. Strix published the disclosure on September 15, two months after Baseten fixed it.

Key takeaways

The credential was written into a container image's build history on March 3, 2023 and still authenticated when tested in July 2026.
It carried repo scope with admin and push rights on Baseten's main product repository, the GitOps repository driving its clusters, and its Homebrew tap.
Baseten's security team made the registry private and rotated the token within roughly 17 hours of the report.

How a scan got there

The run started with ordinary reconnaissance - host enumeration and certificate log inspection - which surfaced a Harbor container registry on a Baseten subdomain. Harbor groups images into projects, and one project on that instance was public. No token was needed to list its repositories, mint an anonymous pull scope, and download manifests and blobs, including an image named baseten/baseten-app.

An exposed registry alone is unremarkable; plenty of companies publish images deliberately. The question is what the image contains. A first find, a pair of AWS keys, turned out to be dead - a read-only identity call returned an invalid-token error. The agent kept going, pulled the layers, ran the open-source scanner TruffleHog, and then read the image config rather than just the filesystem.

The credential was in metadata, not a file

The token sat in the created_by field of the build history, a record of the command that produced each layer. The step in question had expanded a GITHUB_TOKEN build argument directly into a RUN line so the build could fetch private dependencies over Git. Docker stores that history in the image config, which downloads alongside the image itself.

This is the detail worth carrying away: deleting a credential file from a layer does nothing if the build history still holds a copy. The pattern compounds when a build also writes an authenticated remote URL into a global Git config, leaving a second copy behind.

A read-only request to GitHub returned 200 for an account named basetenbot, with repo scope and membership in the basetenlabs organization. Per-repository checks came back with admin and push on three repositories, plus read and write access to other private ones including customer-specific repos. Strix says it stopped there - no clones, no pushes, no configuration changes - and sent the disclosure email.

The response was fast

The timeline in the writeup is unusually tight for a vendor report. Strix filed at 11:10 PM on July 13. By the following morning the Harbor project was private, though the token itself was still live. At 4:34 PM on July 14 Baseten confirmed the issue as critical, said the token had been rotated, and asked the researchers to securely delete the pulled images, which they confirmed half an hour later. Remaining findings closed on July 17, and Baseten reviewed a draft of the post before publication.

Why old images keep doing this

Baseten, valued at $13 billion, is not an outlier in tooling or attention - the disclosure notes the company already runs AI security tooling of its own. The failure is that a build artifact from 2023 was never treated as part of the attack surface after the code around it moved on. Changing a Dockerfile does nothing about an image someone has already pulled, which is why revocation, not remediation, is the step that matters.

The recommended fix is a BuildKit secret mount so the credential never persists, followed by inspecting both layers and history. It is the same class of problem that keeps surfacing across the software supply chain, where a package live for 86 minutes can reach hundreds of millions of installs.

There is a second story here about who found it. An AI agent chained recon, registry enumeration, a dead-end credential, a metadata search, and permission mapping without being told to look for Harbor or for a token. That capability is not restricted to vendors doing diligence on Baseten before signing a contract.

FAQ

Was customer data accessed?

No. Strix states it verified the token's permissions using read-only GitHub requests and stopped there, without cloning the customer repositories it had access to, pushing code, or altering any configuration. It deleted the container images it had pulled at Baseten's request.

How was the token exposed if the files were clean?

It was recorded in the container image's build history rather than in a file. Docker saves the command that created each layer in the image config, and the build had interpolated the token value directly into a RUN command. That config downloads with the image.

How should build credentials be handled instead?

Use a BuildKit secret mount, which makes the credential available during the build without persisting it in the image or its metadata. Existing images should be audited for both layer contents and build history, and any credential found in a published image must be revoked rather than merely removed.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#container-security\",\"item\":\"https://ainewsway.com/tag/container-security\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/container-security#itemlist\",\"name\":\"#container-security Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/an-ai-pentester-found-a-3-year-old-admin-token-in-25-minutes-mu3et6oy\",\"name\":\"An AI Pentester Found a 3-Year-Old Admin Token in 25 Minutes\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# container-security"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","container-security"]}],[["$","$L1e",null,{"articles":[{"id":"ae20c673-a8f7-4a55-931c-f35e6474c78a","slug":"an-ai-pentester-found-a-3-year-old-admin-token-in-25-minutes-mu3et6oy","title":"An AI Pentester Found a 3-Year-Old Admin Token in 25 Minutes","subtitle":"A GitHub credential baked into a 2023 container build was still live in July 2026 - and sitting in a public registry","content":"$1f","excerpt":"An autonomous scanner found a live GitHub admin token in a public Baseten container image, written into the build history in March 2023.","coverImage":"https://cdn.ainewsway.com/uploads/2026/09/3abb5967-3fc1-4420-81f7-5172ccf80c3c.webp","coverImageCaption":"Server racks in a data center - Baseten runs AI inference infrastructure, where a stale build credential granted admin rights on the repositories driving its clusters","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-09-16T01:16:21.936Z","viewCount":0,"likeCount":0,"readingTime":5,"isFeatured":false,"isBreakingNews":false,"metaTitle":"AI Pentester Found a 3-Year-Old Admin Token in 25 Minutes","metaDescription":"A GitHub token baked into a 2023 Baseten container build still granted repo admin in July 2026. An autonomous scanner found it in 25 minutes.","metaKeywords":["Baseten","Strix","GitHub personal access token","container registry","Harbor","supply chain security","Docker build history","AI pentesting"],"ogImage":null,"aiSummary":"Security vendor Strix disclosed on September 15, 2026 that its autonomous scanning agent found a live GitHub personal access token in a publicly readable Baseten container registry within about 25 minutes. The credential was baked into an image build history on March 3, 2023 and still granted admin rights on Baseten's product and GitOps repositories in July 2026. Baseten rotated it within a day, but the case shows old container metadata remains an unchecked attack surface.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":95,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-09-16T01:15:55.043Z","updatedAt":"2026-09-16T01:16:21.936Z","contentUpdatedAt":null,"deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"4bbc00ee-63c2-40b5-a588-8b0fb754c6f9","name":"SaaS & Cloud","slug":"saas-cloud"}],"tags":[{"id":"e33c0738-d08b-4b6d-81af-b4cac24c1a4b","name":"GitHub","slug":"github"},{"id":"c3ea531c-0bd4-483a-8d99-b10d931913b2","name":"Supply Chain Security","slug":"supply-chain-security"},{"id":"6728fec9-4f9a-449e-9156-f2a4e12624df","name":"Baseten","slug":"baseten"},{"id":"ef116fdf-e174-4d66-bfd7-8e58c9542d52","name":"Container Security","slug":"container-security"},{"id":"dec639b3-be5d-487e-a232-fba9c39edf76","name":"AI Pentesting","slug":"ai-pentesting"}],"translations":[],"celebrities":[{"id":"2039e55c-8b98-4256-8a44-dc45e024bb18","nameKo":"베이스텐","nameEn":"Baseten","slug":"baseten","profileImage":null}]}]}],"$L20"]]}]

#container-security

An AI Pentester Found a 3-Year-Old Admin Token in 25 Minutes

Subscribe to Newsletter

#container-security

An AI Pentester Found a 3-Year-Old Admin Token in 25 Minutes