Strix says it tested Baseten before using the company for inference and, within about 25 minutes, found a public Harbor container registry path to an old Docker image containing a still-valid GitHub personal access token. The token belonged to basetenbot and had repo-scope access.
According to Strix, the token gave admin and push access to Baseten’s main product repo, its GitOps repo controlling clusters, its Homebrew tap, and read/write access to other private repositories including customer-specific repos. The Docker image build dated to March 2023, and the token was still active when Strix found it in July 2026.
Baseten’s response matters too. Strix says Baseten confirmed the issue as critical, made the Harbor project private, rotated the token by the next afternoon, requested deletion of pulled images, and closed lower-severity findings quickly. That is the right incident posture, but it does not erase the core lesson.
Grey Haven’s read: AI infrastructure vendors are now inside the customer blast radius. Inference providers, agent platforms, sandbox vendors, and model-hosting services often sit near proprietary prompts, customer data, deployment credentials, and production workflows. Their stale build metadata is not their problem alone.
The operator move is to upgrade vendor review from paperwork to evidence. Ask how registries are scanned, whether Docker build history is checked, how long-lived tokens are retired, and whether GitOps repositories are separated from product repos. For high-trust AI vendors, a short adversarial surface check may be cheaper than believing a security questionnaire. Source: Strix, September 1, 2026.
