AI Pen-Testing Agent Obtains Admin Access to Baseten's GitHub in 25 Minutes
Security researchers using an automated AI penetration-testing agent discovered an active, high-privilege GitHub Personal Access Token inside Baseten's public Docker container build history. The exposed token granted full administrative access to Baseten's core product, cluster GitOps repositories, and private customer code within 25 minutes. This incident highlights how autonomous AI agents can dramatically accelerate vulnerability discovery and exploitation, turning minor cloud misconfigurations into rapid total system compromises. It serves as a stark reminder for DevSecOps teams to strictly audit container metadata and implement secure secret management. The leaked token belonged to a service account and provided administrative push access across primary GitHub repositories, cluster configuration pipelines, and custom Homebrew packages. Baseten acted swiftly upon responsible disclosure, privatizing the registry project and revoking the compromised credential.
## BACKGROUND
Docker images are built in sequential layers, meaning sensitive build arguments or environment variables exposed during image construction remain stored in the metadata history even if removed in subsequent steps. Baseten is an enterprise infrastructure platform that deploys and scales open-source and proprietary machine learning models.