We got admin access to Baseten's production GitHub in 25 minutes

一句话概要

We gave Strix a domain. In 25 minutes, it found a live token with admin access to Baseten’s product, deployment, and CLI repos in a public Docker image.

原文开头节选

We were about to trust Baseten with our own and our customers’ data. So to be safe, we ran Strix to ensure they were secure first. About 25 minutes later, it had a live GitHub token with repository-level admin rights on internal Baseten repos.

We build Strix , an autonomous hacking agent, which of course means we need (cheap and fast) inference. We were exploring our options, and Baseten is one of the obvious choices. It’s a great product, they’re valued at $13 billion , and a lot of serious companies depend on them.

But… we’re a security company. Before we give a third party our data, models, or code, we scan them. We would much rather find a problem and help get it fixed before we start depending on that service (we do this with almost all of our vendors and have a high rate of finding serious issues).

So… we pointed Strix at *.baseten.co and let it run without credentials or source code.

(以上为原文节选,完整内容见下方”原文来源”)

这条动态今日登上 Hacker News 首页(157 赞 / 71 评论,来源 strix.ai)。技术雷达每日自动聚合 AI 工程、后端架构、DevOps 方向的前沿动态;相关工程落地可浏览下方的相关服务与延伸阅读,或直接与我们团队交流。