TORONTO, November 2, 2026 —

An AI agent built to help administrators query identity data became the privileged path itself. Two flaws disclosed on October 30 in the TAKO AI Agent for Okta, a local-first Okta administration agent, show what happens when an agent that touches identity systems runs code without the controls that would apply to any other privileged service.

The lead flaw, tracked as CVE-2026-63378, carries a CVSS score of 8.8 and is classed as CWE-94, improper control of generation of code. It affects all versions before 3.0.1-beta and is fixed in that release. Any user with a valid session cookie could exploit it, without administrator-level privileges. Submitted Python code passed the agent's validation, which missed string-based imports, while dynamic calls through builtins evaded its AST checker. The accepted code was written to a temporary file and executed through a subprocess call. By default, the container ran that process as the root user, and output could be retrieved through Server-Sent Events. It could expose Okta API tokens, the JWT signing key, and the SQLite database.

The second flaw, CVE-2026-63377, rated critical at 9.8, was fixed in the same release. Before 3.0.1-beta, the first-run setup endpoint required no authentication, bootstrap token, or network restriction, and the default Docker configuration published port 8001 on all interfaces. Anyone who could reach the server before its owner finished setup could create the first administrator account, read Okta-synced user data, API tokens, chat history, and configuration, and lock out the legitimate administrators.

No use of either flaw in real attacks has been reported. The lesson does not depend on exploitation. An agent with access to identity data, API tokens, and configuration is a privileged system, and its execution path is part of its attack surface. Its code, privileges, and sessions need the same scrutiny as the model it calls.

That is the distinction Securetron draws between patching and governing. Patching to 3.0.1-beta closes these two flaws, and teams running TAKO should update, rotate exposed tokens and keys, and review logs for unauthorized script execution. Governing covers the next flaw in the next agent: runtime inspection of prompts and responses, least-privilege access to tools and data, authenticated agent identity, and an audit record of every transaction.

AI-FW, Securetron's AI firewall and governance gateway, sits between AI agents and the models they call. Every prompt and response is scanned in real time for jailbreaks and prompt injection, with PII masking and data-exfiltration blocking on every request. Agent identity is authenticated with API keys, JWT, mTLS, or Kerberos, roles are enforced with RBAC, and every transaction lands in a metadata-only audit log. The gateway is fail-closed by design, retains zero content, and keeps provider keys server-side, so endpoint agents never need to hold them.

Securetron does not claim AI-FW would have blocked these TAKO flaws or patches TAKO. When an agent can reach identity data and run code, its traffic, identity, and policy must be governed at runtime, not assumed safe inside the perimeter.

"An identity agent that runs code as root on a session cookie is not a prompt problem, it is a privilege problem," said Sarah Reid, Securetron spokesperson. "Patch the agent, rotate the tokens, and then govern the traffic. The next agent flaw will not announce itself, and the control that catches it has to already be in the path."

The Community Edition of AI-FW is proprietary free-to-use software and includes enterprise-grade features with 10 billion tokens per rolling 30 days and no credit card required. It is not open source. For more information, visit https://aifw.io.

About Securetron
Securetron builds enterprise security infrastructure: AI-FW, the self-hosted AI firewall and governance gateway between AI agents and LLM backends, and PKI Trust Manager with Boltron-AI for certificate lifecycle automation. For more information, visit https://aifw.io and https://securetron.net.

Press Contact
Sarah Reid
Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]