huggingface/smolagents · error · InterpreterError

Forbidden access to module: {result['__name__']}

Error message

Forbidden access to module: {result['__name__']}

What it means

Same security check as the ModuleType case, but the returned object is a dict that looks like a module (it has a '__spec__' key, e.g. a module's __dict__ or a lazy/partial module object). If the module named in result['__name__'] is not in authorized_imports, the executor raises InterpreterError to prevent smuggling an unauthorized module out of the sandbox.

Source

Thrown at src/smolagents/local_python_executor.py:173

def check_safer_result(result: Any, static_tools: dict[str, Callable] = None, authorized_imports: list[str] = None):
    """
    Checks if a result is safer according to authorized imports and static tools.

    Args:
        result (Any): The result to check.
        static_tools (dict[str, Callable]): Dictionary of static tools.
        authorized_imports (list[str]): List of authorized imports.

    Raises:
        InterpreterError: If the result is not safe
    """
    if isinstance(result, ModuleType):
        if not check_import_authorized(result.__name__, authorized_imports):
            raise InterpreterError(f"Forbidden access to module: {result.__name__}")
    elif isinstance(result, dict) and result.get("__spec__"):
        if not check_import_authorized(result["__name__"], authorized_imports):
            raise InterpreterError(f"Forbidden access to module: {result['__name__']}")
    elif isinstance(result, (FunctionType, BuiltinFunctionType)):
        for qualified_function_name in DANGEROUS_FUNCTIONS:
            module_name, function_name = qualified_function_name.rsplit(".", 1)
            if (
                (static_tools is None or function_name not in static_tools)
                and result.__name__ == function_name
                and result.__module__ == module_name
            ):
                raise InterpreterError(f"Forbidden access to function: {function_name}")


def safer_eval(func: Callable):
    """
    Decorator to enhance the security of an evaluation function by checking its return value.

    Args:
        func (Callable): Evaluation function to be made safer.

View on GitHub (pinned to 30bb116109)

Solutions

1. Whitelist the module via additional_authorized_imports if it is genuinely needed
2. Return plain data (e.g. a specific attribute or a copy of needed keys) instead of the module __dict__
3. Audit the generated code: returning __spec__-bearing dicts is usually a sandbox-escape attempt and should be rejected in the prompt

Example fix

# before
code = "import os
os.__dict__"

# after
code = "import os
final_answer(os.getcwd())"

def is_module_like(v) -> bool:
    return isinstance(v, dict) and v.get('__spec__') is not None

def is_module_like(v) -> bool:
    return isinstance(v, dict) and v.get('__spec__') is not None

from smolagents.local_python_executor import InterpreterError
try:
    evaluate_python(code, additional_authorized_imports=authorized)
except InterpreterError as e:
    if 'Forbidden access to module' in str(e):
        log_sandbox_violation(code, e)

When it happens

Trigger: Executed code returns a module's __dict__ (e.g. `vars(os)` or `os.__dict__`), or an object that carries a __spec__ entry, and the named module is not whitelisted in authorized_imports.

Common situations: LLM-generated code tries to exfiltrate a module by wrapping it in its __dict__; introspection code like `vars(module)` as the final expression; returning a namespace-like object built from a non-authorized module.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Forbidden access to module: {result.__name__}
• Forbidden access to function: {function_name}
• Object is not iterable
• Forbidden access to dunder attribute: {expression.attr}
• Unsupported statement in class body: {stmt.__class__.__name_

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/cbe1de98dcc03709. Report an issue: GitHub.