Open-source AI hacker got admin on Baseten's GitHub in 25 minutes
Strix, a 60k-star open pentest agent, found a live GitHub token in a public Docker image — the same tool you can point at your own stack this weekend.
Copy markdown
The chain: a public image, a 3-year-old token, admin on prod
Strix pulled Baseten's public baseten-app image from an unauthenticated Harbor registry and found a basetenbot GitHub PAT baked into the Docker build history — live since March 2023. It carried repo-scope admin on three repos: the product code, the GitOps repo holding production cluster state, and the Homebrew tap that ships their CLI. Elapsed time: about 25 minutes, fully autonomous.
Point the same AI hacker at your own stack
Strix is open source (Apache-2.0, 60k+ stars). Install with `curl -sSL https://strix.ai/install | bash`, then `strix --target ./your-app` — or aim it at a repo, URL, or OpenAPI spec, no source access needed. It defaults to GLM-5.3 on OpenRouter, ships working proof-of-concept exploits, and runs in GitHub Actions for CI.
Secrets in Docker build args never really leave
The token survived because it was passed as a build argument, which Docker records permanently in history[].created_by — even after the file is deleted. Fix it this week: use BuildKit --mount=type=secret, scope PATs to the minimum and set expirations, and scan image history, not just the final layers.
Fixed fast — but the pattern is generic
Baseten made the registry private and rotated the token within about 24 hours of the July 13 report; the public write-up dropped this week. Nothing here is Baseten-specific — a leaked PAT in a public container image is a vector for anyone shipping Docker images, so audit every registry you've ever pushed to.
Elsewhere: Panel, an agent that builds its own UI
Panel (MIT, open source) is a local research workspace where the coding agent can spin up custom docked panes on demand — an SQLite browser, a protein-structure viewer — next to chat, PDFs, and Jupyter. Claude Code is the supported harness today.