What happened
The local-first Okta AI agent registers its administrator through an unauthenticated setup endpoint. An attacker who reaches the endpoint before (or races) the legitimate admin can create the first administrator account, granting full control of the agent's Okta tenant querying and configuration.
Why it matters
This is an AI-agent-specific unauthenticated privilege-establishment flaw: the attacker becomes the trusted administrator of an agent that holds Okta tenant data. Combined with the agent's script-execution surface (CVE-2026-63378), it yields full tenant compromise and credential/token disclosure from a completely unauthenticated position.
Attack vector
POST /api/auth/setup in src/api/routers/auth.py does not authenticate the request, so any unauthenticated network attacker can create the first administrator account before the legitimate setup flow completes.
Affected systems
TAKO AI Agent for Okta prior to 3.0.1-beta
Mitigation
Upgrade to TAKO AI Agent for Okta 3.0.1-beta. Fix commit: https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4