huggingface/smolagents · warning · FutureWarning

Deserializing pickle data. This is a security risk if the da

Error message

Deserializing pickle data. This is a security risk if the data is untrusted.

What it means

serialization.loads warns with this FutureWarning whenever it encounters the pickle-safe prefix and deserializes via pickle.loads (data created by the pickle fallback path, with allow_pickle=True). The warning flags the security risk of unpickling, since malicious payloads can execute arbitrary code.

Source

Thrown at src/smolagents/serialization.py:324

        Raises:
            SerializationError: If pickle data received but allow_pickle=False
        """
        if data.startswith(SafeSerializer.SAFE_PREFIX):
            json_data = json.loads(data[len(SafeSerializer.SAFE_PREFIX) :])
            return SafeSerializer.from_json_safe(json_data)
        elif data.startswith("pickle:"):
            # Explicit pickle prefix
            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "
                    "This data is pickle-serialized. To deserialize it, set "
                    "allow_pickle=True (not recommended for untrusted data)."
                )
            # Warn about insecure pickle deserialization
            import warnings

            warnings.warn(
                "Deserializing pickle data. This is a security risk if the data is untrusted.",
                FutureWarning,
                stacklevel=2,
            )
            return pickle.loads(base64.b64decode(data[7:]))
        else:
            # No prefix - legacy format, assume pickle
            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "
                    "This data appears to be pickle-serialized (legacy format). To deserialize it, set "
                    "allow_pickle=True (not recommended for untrusted data)."
                )
            # Warn about insecure pickle deserialization
            import warnings

            warnings.warn(
                "Deserializing pickle data. This is a security risk if the data is untrusted.",

View on GitHub (pinned to 30bb116109)

Solutions

  1. Eliminate pickle-producing objects at the dumps side (use safe types) so loads never hits the pickle branch
  2. Only set allow_pickle=True for data you produced yourself; never for untrusted input
  3. Filter FutureWarning if the data is trusted and you accept the risk temporarily
  4. Long term, remove pickle fallback usage before smolagents deletes it

Example fix

# before
data = dumps({'obj': CustomObject()})
res = loads(data, allow_pickle=True)  # warns

# after
data = dumps({'obj': {'x': 1}})  # safe types only
res = loads(data)  # no warning, no pickle
Defensive patterns

Strategy: validation

Validate before calling

from smolagents.serialization import SafeSerializer
def safe_loads(data: str):
    if data.startswith(SafeSerializer.SAFE_PREFIX if hasattr(SafeSerializer, 'SAFE_PREFIX') else 'PICKLE::'):
        raise ValueError('refusing to unpickle untrusted data')
    return loads(data)

Type guard

def is_pickle_payload(data: str) -> bool:
    return not data.startswith('{') and '|' in data and data.split('|')[0] not in ('json',)  # adjust to actual prefix

Try / catch

try:
    obj = loads(data)
except Exception:
    raise ValueError('serialized data unreadable; regenerate from safe types')

Prevention

When it happens

Trigger: Loading serialized smolagents state that contains any object outside the safe-type set; round-tripping dumps()->loads() where the dumps side already fell back to pickle.

Common situations: Restoring saved agents/memories from disk or across services; CI with warnings-as-errors failing on the FutureWarning; consuming serialized data from untrusted sources (dangerous).

Related errors

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/4baae1b61487d0ad. Report an issue: GitHub.