huggingface/smolagents · error · InterpreterError

Invoking a builtin function that has not been explicitly add

Error message

Invoking a builtin function that has not been explicitly added as a tool is not allowed ({func_name}).

What it means

The sandboxed executor only allows calling builtin functions (like len, sum, open, exec) if they were explicitly registered as tools in static_tools. This blocks agent code from escaping the sandbox via arbitrary builtins.

Source

Thrown at src/smolagents/local_python_executor.py:907

                return super(state["__class__"], state["self"])
            else:
                raise InterpreterError("super() needs at least one argument")
        cls = args[0]
        if not isinstance(cls, type):
            raise InterpreterError("super() argument 1 must be type")
        if len(args) == 1:
            return super(cls)
        elif len(args) == 2:
            instance = args[1]
            return super(cls, instance)
        else:
            raise InterpreterError("super() takes at most 2 arguments")
    elif func_name == "print":
        state["_print_outputs"] += " ".join(map(str, args)) + "\n"
        return None
    else:  # Assume it's a callable object
        if (inspect.getmodule(func) == builtins) and inspect.isbuiltin(func) and (func not in static_tools.values()):
            raise InterpreterError(
                f"Invoking a builtin function that has not been explicitly added as a tool is not allowed ({func_name})."
            )
        if (
            hasattr(func, "__name__")
            and func.__name__.startswith("__")
            and func.__name__.endswith("__")
            and (func.__name__ not in static_tools)
            and (func.__name__ not in ALLOWED_DUNDER_METHODS)
        ):
            raise InterpreterError(f"Forbidden call to dunder function: {func.__name__}")
        return func(*args, **kwargs)


def evaluate_subscript(
    subscript: ast.Subscript,
    state: dict[str, Any],
    static_tools: dict[str, Callable],
    custom_tools: dict[str, Callable],

View on GitHub (pinned to 30bb116109)

Solutions

1. Add the needed function to static_tools (or the agent's tools) when constructing the executor/agent, e.g. add smolagents's safe functions or your own wrapper
2. Replace the builtin with an allowed tool (e.g. read files via a provided file-reading tool instead of open())
3. Restructure the code to avoid the builtin entirely (use math instead of sum-of-floats tricks, string methods instead of format builtins, etc.)

Example fix

# before
content = open('data.txt').read()  # blocked
# after
# provide a tool:
# agent = ToolCallingAgent(tools=[ReadFileTool()], ...)
content = read_file('data.txt')

# before running agent code, register the builtins you actually need
static_tools = base_python_tools.copy()
static_tools['len'] = len  # example: explicitly allow

try:
    evaluate_python(code, static_tools=static_tools, ...)
except InterpreterError as e:
    if 'not been explicitly added as a tool' in str(e):
        # parse builtin name, add to static_tools or rewrite code, retry

When it happens

Trigger: Calling any builtin (e.g. open('f'), exec(s), eval(s), input(), help(), compile()) that is not in the agent's tools and not in the interpreter's small allowed set.

Common situations: Agent-generated code tries to open files, read stdin, or exec dynamic strings; using a builtin shadowed by an import; relying on builtins available in normal Python but not whitelisted by smolagents.

Related errors

• Forbidden call to dunder function: {func.__name__}
• Import of {alias.name} is not allowed. Authorized imports ar
• Import from {expression.module} is not allowed. Authorized i
• Forbidden access to module: {result.__name__}
• Forbidden access to module: {result['__name__']}

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/679e31360b4ee463. Report an issue: GitHub.