We got admin access to Baseten's production GitHub

Original Article ↗ Hacker News Discussion ↗

An autonomous “hacking agent” from security startup Strix found a long‑lived GitHub personal access token embedded in a public Baseten Docker image, which granted admin access to core product and infrastructure repositories. Commenters praise the prompt private remediation but question the absence of a meaningful bug bounty, the ethics and legality of aiming aggressive pen‑testing tools at third parties, and what this implies for SOC 2–style compliance. The incident fuels broader concern that AI‑assisted attackers can cheaply uncover misconfigurations like leaked tokens and weak GitOps practices, raising the bar for secret management, least privilege, and short‑lived credentials.

Overview of the incident & response

  • Strix used its autonomous “hacking agent” on Baseten’s infrastructure and discovered a GitHub personal access token embedded in a Docker image’s build history.
  • The token had broad admin/push access across core product, GitOps, Homebrew, and customer-related repos, and had been valid for ~3 years.
  • Commenters note this was an easily preventable, classic “dropped key” mistake, not a sophisticated exploit.
  • Baseten is widely viewed as having responded professionally: quick remediation, token rotation, making images private, closing follow‑up findings, and collaborating on disclosure.

Bug bounty, rewards & incentives

  • Many see “swag only” for such a critical bug as inadequate, especially given Baseten’s high valuation and the severity of the access.
  • Others argue this was a B2B security evaluation, not hobby research, so financial rewards are less expected; compensation might instead be in services, discounts, or publicity.
  • There’s concern that weak incentives push researchers toward selling vulns or public 0‑day drops instead of responsible disclosure.

Legality & ethics of the test

  • Strong debate over whether Strix’s actions were legal and ethical without explicit prior permission.
  • Some compare it to finding and returning a lost key; others emphasize that validating the token and enumerating private repos crosses into unauthorized access under laws like the CFAA (jurisdiction‑dependent).
  • A number of commenters assume there must have been negotiated “permission to attack”; others doubt this since it isn’t clearly stated. Overall, permission status is unclear.

AI agents, capabilities & risk

  • Many note that this exploit could have been found with traditional tools; the novelty is speed and automation, not new capability.
  • Concern that similar agent-driven scans are likely already being used by malicious actors, especially given how low the bar for attacks has become.
  • Some push back on anthropomorphizing agents (“Strix decided…”), insisting these are tools, not autonomous beings.

Security practices: GitHub, Docker, GitOps

  • Criticism of long‑lived GitHub PATs, lack of default expiry, and embedding secrets in images.
  • Suggestions: short‑lived/OIDC credentials, strict least privilege, treating agents like untrusted CI jobs, secret scanning that includes registries, and better Docker build practices.
  • Debate over GitOps and CI‑driven infra applies vs. manual applies from admin machines; most agree automation is fine if credentials are tightly scoped and short‑lived.

Reputation, compliance & marketing

  • Some see this as bad optics for a SOC2/HIPAA‑branded vendor; others say compliance is largely box‑ticking and doesn’t prevent such mistakes.
  • Strong consensus that the story is excellent marketing for Strix, raising awareness of its product, while also making more people aware of Baseten—both positively (transparent response) and negatively (critical lapse).