A 3-year-old admin token sat in a public Baseten container image. An outside red team pulled it in 25 minutes.

A roughly three-year-old admin token sat in a public container image on a server run by Baseten, the AI-inference company that hosts machine-learning models for other businesses. The AI-security vendor Strix found the credential in about 25 minutes during a black-box test, with no source code and no insider access. The token had admin and push rights on Baseten's main product repo, its GitOps cluster repo, and its Homebrew tap, plus read and write access on per-customer repositories.

A Harbor project on a Baseten subdomain, gcp-us-east4-zlw.registry.baseten.co, was configured to allow unauthenticated listing and anonymous pulls of a baseten/baseten-app image. Container registries are the storage layer that holds the packaged versions of software that production servers run; in this case, the registry lived on a subdomain that was reachable from the public internet and was treated as open. The image itself had been built in March 2023, and inside the image sat a GitHub personal access token that belonged to the basetenbot account. That token still worked in July 2026. No one had rotated it in the roughly three years since the image was built.

Four small misses, none of them exotic, compounded into the exposure. A subdomain outside the radar of the public-facing product surfaces. A Harbor project left in a default-open configuration. A long-lived personal access token embedded directly in the image rather than pulled at runtime from a secrets manager. No automated check that an exposed container should still hold a credential of that scope. Together they produced an admin-grade credential that a stranger could pull from the public internet.

Strix describes the scan as vendor due diligence. The company was considering Baseten for inference workloads and ran its autonomous red-team tool against the *.baseten.co surface before signing on. The whole exercise took about 25 minutes, according to Strix's public writeup and the researcher's first-person timeline on Hacker News. Strix values Baseten at about $13 billion, citing Baseten's own Series F announcement. That figure originates with Strix; Baseten has not, in the materials reviewed here, confirmed it on the record.

Baseten's response, on the timeline Strix published, was fast. Strix reported the finding on July 13 at 11:10 p.m. By the next morning, the Harbor project was private. By 4:34 p.m. on July 14, the token had been rotated, with a Baseten security engineer (Anton) classifying the issue as critical. The remaining findings were closed by July 17. Public disclosure followed a pre-notice window and shipped in September. A 24-hour rotation window on a critical-severity credential is unusual for this category of disclosure, and most vendor writeups do not include that beat.

For security and platform teams, the move is a recon pass, not a magic scanner. Before onboarding an AI-infrastructure vendor, a buyer can run a no-credential sweep that enumerates subdomains, mines certificate transparency logs for forgotten hostnames, and walks public container registries for any project the vendor forgot to lock down. None of those steps requires access to the vendor's code, and each one surfaces a class of bug that traditional pen-test scopes miss. A second check, internal to the buyer, is whether the vendor's image-build pipeline rotates embedded secrets. A token that lives for three years inside a published image is not a misconfiguration in any one place; it is a rotation policy that never caught up to the surface.

Strix is the disclosing party and also a would-be Baseten inference customer that sells scanning services, and the writeup's framing serves Strix's commercial interest even if the underlying finding is real. The exposure is a single incident at a single vendor; generalizing it to "every AI-inference vendor leaves admin tokens in public registries" would be a reach without more evidence. No independent Baseten statement is in the source bundle, and the $13 billion figure carries Strix's signature. What the disclosure does carry, on its own, is a clean mechanism: a public registry project, an embedded long-lived secret, and no rotation policy catching it before an outside red team did.