From the Slack conversation:

OidcAuthenticator.java assumes the users has already logged in to Atlas (at which point the okta user and atlas user are linked) where the compass flow can skip going to Atlas, this may be a risk you guys want to handle as officially we only support okta tokens for the CLI and you are in a best effort kind of space

This means that users who signed in to Atlas in Compass and never visited any of the cloud.mongodb.com pages (even account.mongodb.com doesn't count) might see an error trying to use generative AI feature. There is no solution for this right now, the only workaround is to open cloud.mongodb.com at least one in your browser.