TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-beta, any authenticated user with a valid "fctr_session" cookie can submit arbitrary Python source in the "script_code" field of "POST /api/react/execute-script", without administrator privilege. In "src/api/routers/react_stream.py", the source is stored with "skip_discovery=True", bypassing AI-based content filtering, and is passed to "validate_generated_code" in "src/utils/security_config.py". "BLOCKED_PATTERNS" recognizes direct "__import__" calls but misses the import name passed as a string, "getattr" is in "ALLOWED_BUILTINS", and the AST checker handles "ast.Name" and "ast.Attribute" targets but fails to handle "ast.Call" targets. Dynamic "getattr" call chains through "__builtins__" therefore evade validation. The "_write_temp_script" helper writes the accepted code to disk, and "asyncio.create_subprocess_exec()" executes it as the application process user, which is root in the default container. Command output is returned as Server-Sent Events through "GET /api/react/stream-react-updates?process_id=<id>". The resulting container compromise can disclose environment secrets including Okta API tokens and the JWT key, expose the SQLite database, and permit backend-service pivoting and persistence. This issue is fixed in version 3.0.1-beta.