AIKIDO-2026-274449

TL;DR

IPython's guarded evaluator used for tab completion falls back to typing.get_type_hints() after the active policy has already refused an attribute access. That helper resolves stringized annotations with bare eval(), so under PEP 563 every annotation becomes executable code. Completing obj.attr against a class whose __annotations__ contain attacker-controlled strings therefore runs arbitrary Python under the default limited policy. The fix collects raw annotations with inspect.get_annotations(eval_str=False) and resolves them through eval_node so they pass the same policy checks as the rest of the input.