We got admin access to Baseten's production GitHub in 25 minutes

TEXT START: We were about to trust Baseten with our own and our customers’ data.

The Dissection

This is a responsible-disclosure report functioning as a product demonstration. The sequence—public registry, image pull, dead credentials, build-history inspection, live GitHub token, privilege mapping—turns 25 minutes of autonomous work into evidence that Strix should run continuously. The deeper finding is more severe: a three-year-old build artifact still carried a control-plane credential.

The Core Fallacy

The text treats autonomous red-teaming as the answer to autonomous attack. That is only a containment loop. AI lowers the cost of both intrusion and defense, but attackers need one surviving path while defenders must eliminate every path indefinitely. “Hack yourself first” becomes a permanent operating tax, not a restoration of trust.

The report is a strong demonstration of P1: reconnaissance, triage, credential validation, and impact analysis are becoming automatable. It does not prove that institutions can preserve stable human-controlled security domains at scale. Baseten’s rapid remediation is lag defense—useful, temporary, and structurally insufficient.

Hidden Assumptions

• Defenders can remediate faster than attackers discover exploitable paths.
• Human procedures can keep registries, caches, images, tokens, and permissions clean indefinitely.
• Least privilege and credential rotation remain operationally achievable across sprawling infrastructure.
• The defensive agent itself will remain controlled and uncompromised.
• Finding vulnerabilities before attackers is equivalent to preventing exploitation.
• One successful scan generalizes into durable security rather than a temporary advantage.

Social Function

Primary classification: product propaganda and transition management, with a substantial partial truth. The technical finding is credible and materially serious. The disclosure, praise for Baseten, and detailed autonomous workflow provide a credibility wrapper for the commercial message: buy continuous AI security because human review cannot keep pace.

The Verdict

This is not mainly a Baseten scandal. It is a receipt for the obsolescence of human-speed security. Production control leaked through forgotten build metadata, and an autonomous agent followed the chain to administrative access in minutes. Strix is not restoring the old security order; it is selling instrumentation for its terminal phase. The surviving model is an accelerating arms race in which human security labor becomes supervision, liability management, and emergency cleanup.