An AI Infra Company Had a 3-Year-Old Admin GitHub Token Sitting in a Docker Image. Finding That Before an Attacker Does Is a Sellable Audit.

A team of security researchers found a public container registry, pulled one image, and had admin access to an AI infrastructure company's production GitHub in about 25 minutes.

What actually happened

Strix, an autonomous hacking agent, was evaluating Baseten as an inference provider when it enumerated hosts and found a public Harbor registry at gcp-us-east4-zlw.registry.baseten.co. The team pulled the baseten/baseten-app image, ran TruffleHog against it, and inspected the image config. They found a GitHub personal access token for the basetenbot account sitting in the history[].created_by field — left over from a Docker build step dated March 3, 2023. The token was over three years old when discovered in July 2026, and it carried admin and push access to Baseten's production repositories plus read/write access to customer-specific repos.

Baseten's own security team was, in the researchers' words, "professional and very quick to deal with it": the Harbor project was made private the next morning, the token was confirmed critical and rotated within about 17 hours of the initial report, and remaining findings were closed within days. The story hit Hacker News at 166 points and 84 comments.

What this exposes

• Docker build history is an overlooked leak surface — teams scan source repos and CI logs for secrets, but a token baked into an image's build metadata years ago can sit untouched until someone thinks to pull the image and inspect it
• Long-lived admin tokens are still common — a 3-year-old PAT with full admin and push rights is exactly the kind of credential that should have expired or been scoped down long before anyone went looking for it
• The attacker's tool is off-the-shelf — TruffleHog is public and free; the entire discovery took about 25 minutes with widely available tooling, which means anyone can run this scan, including the company itself
• A fast, professional response still doesn't erase the exposure window — Baseten handled the disclosure well, but the token existed for three years before anyone checked

The business idea

Any company that ships Docker images or runs a container registry is a candidate for the same 25-minute scan that found Baseten's token — except run by someone the company hired, not a researcher who happens to publish the results:

• Enumerate the client's public and private container registries and pull production images the way an outside party would
• Run TruffleHog (or equivalent) against image layers and, critically, the build config history — the specific field this leak was found in
• Cross-reference any discovered tokens against their age and scope, flagging anything long-lived or over-privileged for immediate rotation
• Deliver a short report: what was found, what access it granted, and a rotation/scoping policy to prevent recurrence
• Offer this as a recurring engagement for teams that ship images on a regular cadence, since each new build is a new chance to reintroduce the same leak

Why this works now

AI infra companies are shipping containers constantly — inference servers, agent runtimes, model-serving images — often faster than their security review process can keep up. The tooling to find these leaks is public and takes minutes to run. The only reason this became a blog post instead of a quiet incident is that nobody ran the scan first.

Bottom line

A 3-year-old admin token sitting in Docker build history took an outside team about 25 minutes to find with a free tool. Selling the audit that finds this before an outsider does is a scoped, repeatable service — not a hypothetical one.

Sources:

https://www.strix.ai/blog/baseten-harbor-github-pat-takeover