AIKIDO-2026-794998

TL;DR

The Optuna sweeper's custom_search_space configuration option resolves a config-controlled dotted path with the lower-level hydra.utils.get_method() API and later invokes the returned callable. get_method() and its sibling object-lookup helpers intentionally trust their input and skip the execution policy used by instantiate(), so an Optuna multirun configuration or command-line override can select any importable callable in the application's environment for execution in the Hydra controller process. The selected code runs with the privileges of the application and requires only control over the sweep configuration plus an importable target. The fix resolves the configured callback through hydra.utils.instantiate() as a partial callable instead, so the active execution policy authorizes it before use.