What happened
The validate_generated_code AST checker and BLOCKED_PATTERNS filter can be evaded by constructing dynamic getattr/__builtins__ call chains, which the checker does not model. The accepted source is written to disk and executed as the application process user (root in the default container), with output returned over Server-Sent Events.
Why it matters
The agent's intent is that the LLM generates safe code; this bypass lets any authenticated (or, via CVE-2026-63377, an attacker-owned) user run arbitrary code as root inside the container, disclosing Okta API tokens, the JWT key, and the SQLite database, and enabling pivoting and persistence within the agent host.
Attack vector
POST /api/react/execute-script accepts attacker-supplied Python in script_code, but the validator misses getattr/__builtins__ dynamic call chains and the code is executed via asyncio.create_subprocess_exec as the container user (root).
Affected systems
TAKO AI Agent for Okta prior to 3.0.1-beta
Mitigation
Upgrade to TAKO AI Agent for Okta 3.0.1-beta. Fix commit: https://github.com/fctr-id/okta-ai-agent/commit/3b5ccaff8423cdfa6d26f5e133c01b8b71148df4