{"record":{"id":"802b813d244a805d","repo":"huggingface/smolagents","slug":"forbidden-access-to-function-function-name","errorCode":null,"errorMessage":"Forbidden access to function: {function_name}","messagePattern":"Forbidden access to function: (.+?)","errorType":"error_code","errorClass":"InterpreterError","httpStatus":null,"severity":"critical","filePath":"src/smolagents/local_python_executor.py","lineNumber":182,"sourceCode":"\n    Raises:\n        InterpreterError: If the result is not safe\n    \"\"\"\n    if isinstance(result, ModuleType):\n        if not check_import_authorized(result.__name__, authorized_imports):\n            raise InterpreterError(f\"Forbidden access to module: {result.__name__}\")\n    elif isinstance(result, dict) and result.get(\"__spec__\"):\n        if not check_import_authorized(result[\"__name__\"], authorized_imports):\n            raise InterpreterError(f\"Forbidden access to module: {result['__name__']}\")\n    elif isinstance(result, (FunctionType, BuiltinFunctionType)):\n        for qualified_function_name in DANGEROUS_FUNCTIONS:\n            module_name, function_name = qualified_function_name.rsplit(\".\", 1)\n            if (\n                (static_tools is None or function_name not in static_tools)\n                and result.__name__ == function_name\n                and result.__module__ == module_name\n            ):\n                raise InterpreterError(f\"Forbidden access to function: {function_name}\")\n\n\ndef safer_eval(func: Callable):\n    \"\"\"\n    Decorator to enhance the security of an evaluation function by checking its return value.\n\n    Args:\n        func (Callable): Evaluation function to be made safer.\n\n    Returns:\n        Callable: Safer evaluation function with return value check.\n    \"\"\"\n\n    @wraps(func)\n    def _check_return(\n        expression,\n        state,\n        static_tools,","sourceCodeStart":164,"sourceCodeEnd":200,"githubUrl":"https://github.com/huggingface/smolagents/blob/30bb1161095dbae2271e6bc3cc4c219cc3897a57/src/smolagents/local_python_executor.py#L164-L200","documentation":"check_safer_result blocks return values that are functions listed in smolagents' DANGEROUS_FUNCTIONS (e.g. os.system, eval, exec, builtins.compile) unless they are exposed as static tools. If executed code returns such a function and its __name__ matches a dangerous qualified name's function part and its __module__ matches, an InterpreterError is raised.","triggerScenarios":"Executed code's final expression or a decorated function returns a DANGEROUS_FUNCTIONS entry, e.g. `import os` then `os.system`, or `__import__('builtins').eval`, and the function name is not present in static_tools.","commonSituations":"LLM tries to get the sandbox to hand back os.system/eval so the caller can invoke it outside the sandbox; returning open or input builtins; the model 'helpfully' returns a process-spawning callable as the answer.","solutions":["Rewrite the code to perform the operation inside the sandbox and return its result instead of the dangerous function","If you truly need the capability, pass it in as a static tool (add to tools=[...]) so the name check exempts it","Prompt/instruct the agent never to return functions, only serializable results"],"exampleFix":"# before\ncode = \"import os\nos.system\"\n\n# after\ncode = \"import os\nfinal_answer(os.system('ls').returncode)\"","handlingStrategy":"validation","validationCode":"import inspect\nDANGEROUS = {'os.system', 'builtins.eval', 'builtins.exec', 'builtins.compile', 'builtins.open'}\ndef is_dangerous_callable(v, static_tools) -> bool:\n    return (callable(v) and not (static_tools and v.__name__ in static_tools)\n            and f\"{getattr(v, '__module__', '')}.{getattr(v, '__name__', '')}\" in DANGEROUS)","typeGuard":"def is_dangerous_callable(v, static_tools) -> bool:\n    return callable(v) and getattr(v, '__name__', '') in {'system', 'eval', 'exec', 'compile'}","tryCatchPattern":"from smolagents.local_python_executor import InterpreterError\ntry:\n    evaluate_python(code)\nexcept InterpreterError as e:\n    if 'Forbidden access to function' in str(e):\n        raise SecurityViolation(str(e)) from e","preventionTips":["Require generated code to call dangerous functions and return their results, never the functions themselves","Expose needed capabilities as explicit static tools instead","Log and reject snippets whose final expression is a bare imported callable"],"tags":["smolagents","sandbox","dangerous-functions","security","interpreter-error"],"backgroundTag":"sandbox-escape-blocked","analyzedSha":"30bb1161095dbae2271e6bc3cc4c219cc3897a57","analyzedAt":"2026-08-28T18:52:54.169Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}