huggingface/smolagents · warning · FutureWarning

Falling back to insecure pickle serialization. This is a sec

Error message

Falling back to insecure pickle serialization. This is a security risk and will be removed in a future version. Consider using only safe serializable types (primitives, lists, dicts, numpy arrays, PIL images, datetime objects, dataclasses).

What it means

smolagents' safe serializer (dumps) first tries SafeSerializer.to_json_safe; if that raises SerializationError it falls back to base64 pickle, emitting this FutureWarning because pickle fallback is insecure and slated for removal. The pickled payload is prefixed so loads can detect it.

Source

Thrown at src/smolagents/serialization.py:280

            str: Serialized string ("safe:..." for JSON, "pickle:..." for pickle)

        Raises:
            SerializationError: If allow_pickle=False and object cannot be safely serialized
        """
        if not allow_pickle:
            # Safe ONLY mode - no pickle fallback
            json_safe = SafeSerializer.to_json_safe(obj)  # Raises SerializationError if fails
            return SafeSerializer.SAFE_PREFIX + json.dumps(json_safe)
        else:
            # Try safe first, fallback to pickle
            try:
                json_safe = SafeSerializer.to_json_safe(obj)
                return SafeSerializer.SAFE_PREFIX + json.dumps(json_safe)
            except SerializationError:
                # Warn about insecure pickle usage
                import warnings

                warnings.warn(
                    "Falling back to insecure pickle serialization. "
                    "This is a security risk and will be removed in a future version. "
                    "Consider using only safe serializable types (primitives, lists, dicts, "
                    "numpy arrays, PIL images, datetime objects, dataclasses).",
                    FutureWarning,
                    stacklevel=2,
                )
                # Fallback to pickle (with prefix)
                try:
                    return "pickle:" + base64.b64encode(pickle.dumps(obj)).decode()
                except (pickle.PicklingError, TypeError, AttributeError) as e:
                    raise SerializationError(f"Cannot serialize object: {e}") from e

    @staticmethod
    def loads(data: str, allow_pickle: bool = False) -> Any:
        """
        Deserialize string with format detection.

View on GitHub (pinned to 30bb116109)

Solutions

Convert non-safe objects to primitives/lists/dicts/dataclasses before serializing
Represent images as PIL Images, arrays as numpy arrays, timestamps as datetime — all safe
Refactor to avoid pickling untrusted-looking state; treat the warning as a design signal
As a stopgap, catch/filter FutureWarning, but plan migration since pickle fallback will be removed

Example fix

# before
result = {'obj': SomeCustomClass()}
data = dumps(result)  # warns, pickles

# after
from dataclasses import dataclass
@dataclass
class SomeCustomClass:
    x: int
result = {'obj': SomeCustomClass(3)}
data = dumps(result)

Defensive patterns

Strategy: fallback

Validate before calling

from smolagents.serialization import SafeSerializer
def safe_payload(obj):
    try:
        return SafeSerializer.to_json_safe(obj)
    except Exception:
        raise ValueError('convert to primitives/dicts/dataclasses before serializing')

Type guard

from dataclasses import is_dataclass
from datetime import datetime
SAFE = (str, int, float, bool, list, dict, tuple, datetime)
def is_safe_serializable(obj) -> bool:
    return is_dataclass(obj) or isinstance(obj, SAFE)

Try / catch

import warnings
with warnings.catch_warnings():
    warnings.filterwarnings('error', FutureWarning, message='.*pickle.*')
    try:
        data = dumps(obj)
    except FutureWarning:
        data = dumps(sanitize(obj))  # convert to safe types and retry

Prevention

Keep agent state to primitives/dicts/lists/dataclasses
Convert custom objects before storing in tool outputs
Treat the pickle warning as a build error in CI

When it happens

Trigger: Calling serialization.dumps (directly or via agent.to_dict/save) on objects containing types outside the safe set — arbitrary classes, generators, locks, DB handles, custom objects without dataclass support.

Common situations: Tool outputs containing arbitrary Python objects; agent memory holding non-serializable artifacts; environments where FutureWarning-as-error (pytest -W error) turns this into a test failure.

Related errors

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/f5f2858e90c79e64. Report an issue: GitHub.