A Security Agent Found a Live Admin Key From 2023 in 25 Minutes

Security company Strix wanted to use Baseten, a well funded platform for running AI models, to serve its own customers. Before handing over data, it did what it does to most vendors: it pointed its automated hacking agent at the company’s domains, with no passwords and no access to the source code. About 25 minutes later the agent had a working GitHub key with administrator rights on Baseten’s main product repository, on the repository that configures its live clusters, and on its Homebrew distribution channel.

The path it took is worth following, because none of the steps were clever. The agent mapped the company’s public addresses and found a forgotten container registry, a storage service for the packaged software bundles called container images. One area of it was readable by anyone. The agent downloaded an image and first found a pair of Amazon keys, which turned out to be dead. Rather than stopping there, it checked the image’s build history, a log of the commands used to assemble it that travels along with the image itself. In that log sat a GitHub token, pasted into a build command on 3 March 2023. It still worked when Strix tested it in July 2026, more than three years later. Baseten’s security team confirmed the report as critical, locked the registry and revoked the key by the next afternoon, which is unusually fast. Strix waited until September to publish.

What is behind this

The underlying mistake is ordinary and extremely common. Someone needed a build to fetch private code, so they passed a key in as a setting, the build worked, and everyone moved on. What they did not know is that the packaging tool records those settings in the image’s own metadata. You can delete the key from the files inside and the copy in the build history stays. The AI part is not that the agent did anything a skilled human could not. It is the price and the patience: a tool that works through recon, a dead credential, a second credential and a permissions check for 25 minutes without getting bored is a tool that can be pointed at thousands of companies. Do keep in mind that Strix sells this product, so the write up is marketing as well as research, and the technical details still check out.

What this means for you: For most readers this is a story about how fast the attacker side is getting cheaper, and the takeaway is simply that old, forgotten systems are now much more likely to be found. If you or your team build software, three checks are worth an afternoon: see what someone can download from your registries without logging in, read your images’ build history rather than just their files, and look at what your automated build keys can actually reach. A key that only needs to read one library should not have administrator rights on your main product, and it should expire.

Sources

• Strix: We wanted to use Baseten for inference, we ended up with admin access to Baseten GitHub repos
• Docker documentation: build arguments and secrets
• Docker documentation: using build secrets