In 2026, a security firm evaluated Baseten, a $13 billion AI platform. In just 25 minutes, they gained admin access to its core internal code repositories. This near-frictionless intrusion involved absolutely no software vulnerabilities from start to finish.
Scouring Public Image Records to Steal System Admin Rights
Strix, a security company developing autonomous penetration agents, conducted a routine uncredentialed scan on Baseten before handing over data. The starting point for reconnaissance was a container image registry, essentially a cargo container for software packages. One project in the registry was entirely public. Anyone could list files without a password, and even request an anonymous token to download data.
The fatal flaw was stamped on a log called “build history.” When Docker packages software, it engraves every build command into the history, like a timestamped receipt. One configuration command displayed a variable named GITHUB_TOKEN directly in plain text.
Developers used this token as a password substitute, intending to make code pulling smoother for the system. Official documentation explicitly warns that build parameters will be recorded. However, engineers hardcoded the variable directly into the command for convenience. Security standards yielded to development speed, effortlessly crossing known industry red lines.
Image: The token in Docker build history and account info returned by GitHub. Source: Strix Incident Postmortem
A Token Unchanged for Three Years Gives Away Core Repo Management
Following this exposed clue, Strix acquired an active token belonging to a Baseten internal organization. This token granted them access to seven internal repositories. Three high-risk ones came with admin privileges and the highest authority to push code. These three nodes formed the complete supply chain from code development to customer deployment.
Once the main product repository is compromised, intruders can quietly inject malicious logic into the code running AI models. The GitOps repository is the highway straight to production, even containing subdirectories categorized by customer names. Taking over the distribution toolchain is equivalent to opening a backdoor on the computers of all developers using that tool.
The timestamp was stuck at March 3, 2023. Until its discovery in July 2026, this token remained fully functional. The destructive power of a credential lingering three years past its prime far exceeds that of a carefully crafted Trojan. Enterprises spend heavily on firewalls to block external attacks, yet turn a blind eye to internal permissions that haven’t been updated in years.
Image: Token scope and belonging organization returned by GitHub. Source: Strix Incident Postmortem
A $13 Billion Lesson Preventable by a Local Check
Upon receiving the report, Baseten’s security team responded swiftly, rotating the token and locking the public project by the following afternoon. The $13 billion company showed necessary decisiveness in stopping the disaster from spreading. The credential had already leaked in the build history. Modifying the build file at this point couldn’t recall downloaded images. The only remedy was to revoke it at the source.
The direct cause of the incident was engineers using the git config command to write a URL containing the token into the global configuration. The standard practice is to use a temporarily mounted encrypted credential for authentication. Tokens must be “read and burn,” never left on hard drives or in history records.
Preventing this level of credential leakage only requires running a simple keyword-matching filter locally before code goes live. When mandatory review steps are missing from the development process, low-level mistakes will travel unimpeded straight into the production environment.
System Defense Collapse Stems from Routine Developer Habits
The areas where defenders easily drop their guard are often forgotten historical corners. Teams stare at core applications and the newest code repositories, often forgetting a container image long past its maintenance period. Even if you scan the image’s content files, skipping its build history allows that lethal token to remain at large.
The intrusion exploited three vulnerabilities entirely configured by humans: a publicly readable repository, misrecorded parameters, and a token unchanged for three years. There was no devastating unknown technology, only doors left wide open by the gatekeepers themselves.
The security shortcomings of the AI supply chain often hide in the most basic configuration and hygiene habits of engineers. The empirical proof of taking a $13 billion company’s trump cards in 25 minutes sets the most straightforward security baseline: even the most expensive system protection cannot block a skipped inspection command.
References:
- Strix Incident Postmortem
