i quite liked using strix. last time i tried it, deepseek was a mess and bloated the context with nonsense. that was ~5 months ago, i wonder how it performs now

I wonder what model was used for this. Also as far as I know Baseten does not have any abliterated models in their repertoire.

> So Strix enumerated hosts, looked through certificate logs, mapped the full surface.

If there is anything that you should do while setting up infrastructure... it is getting rid of single-host SSL certificates. If you're on Amazon... just let it issue wildcard certificates and place an ALB in front of hosts that terminates the SSL connection. The very second a subdomain appears in any of the CT logs directly, you've lost, it will get hammered.

And keep your public and private Git, Docker, npm and whatnot registries separate infrastructure, with the private stuff only reachable from within the corporate network, preferably just servers. Too many a company got hacked and lost significant data because of someone exploiting a GitLab RCE on an instance that hosted both private and intentionally-public repositories. (Yes, I have been there.)

> It is their GitOps: the repository contains the desired state of the clusters, and it applies that state to the infrastructure.

That's another thing I frankly do not get why people are still doing it.

It's fine to have a Git pipeline do a lint, even a terraform plan using a read-only token (although that token needs access to the statefile aka s3 bucket... and there will be relevant secrets there). But, IMHO, a terraform apply should always, always be run on a machine of a sysadmin manually doing the apply. A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens. But a Git pipeline where there is a cloud provider token with full admin permissions? That is one Gitlab RCE patch or Github issue away from being compromised.

Besides, one repository holding all the IaC stuff? That just sounds like hour long `terraform refresh` sessions.

cannot delete the card from billing.

> We build Strix, an autonomous hacking again.

> But... we're a security company.

> So... we pointed Strix at *.baseten.co and let it run without credentials or source code.

lawyers wet dream. and a perfect case. A security company who KNOWS the law unleashed an AI agent to violate the laws

The article reads like it was written by a child. I imagine their company is run the same way.

It should be illegal to produce software products that people will depend on and are this blatantly insecure

[dead]

The part that matters more than the public Harbor project: the image was built in March 2023 and the token still worked when they found it in July 2026. Over three years. That is a classic PAT with no expiry, which GitHub still lets you create and which is still the easiest thing to reach for when you are wiring up a bot account.

Secret scanning would not have caught it either. It reads repositories, not image layers sitting in a registry on your own subdomain, so the coverage stopped exactly where the leak was.

Anton here from the baseten security team. I wanted to confirm that we collaborated with Strix on the remediation of the reported vulnerability. We thank Strix for their responsible disclosure. We took immediate steps to invalidate the leaked key and remove the public container image. Our logs confirm the vulnerability was never exploited and no customer data was exposed.