huggingface/smolagents · error · SerializationError

Pickle data rejected: allow_pickle=False requires safe-only

Error message

Pickle data rejected: allow_pickle=False requires safe-only data. This data appears to be pickle-serialized (legacy format). To deserialize it, set allow_pickle=True (not recommended for untrusted data).

What it means

SafeSerializer.loads received a string with no recognized prefix, so it assumes the legacy format (raw base64 pickle). Because allow_pickle defaults to False, it refuses to deserialize what is probably pickle data for security reasons. This typically occurs with data serialized before the prefix scheme (safe JSON vs 'pickle:') was introduced.

Source

Thrown at src/smolagents/serialization.py:333

            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "
                    "This data is pickle-serialized. To deserialize it, set "
                    "allow_pickle=True (not recommended for untrusted data)."
                )
            # Warn about insecure pickle deserialization
            import warnings

            warnings.warn(
                "Deserializing pickle data. This is a security risk if the data is untrusted.",
                FutureWarning,
                stacklevel=2,
            )
            return pickle.loads(base64.b64decode(data[7:]))
        else:
            # No prefix - legacy format, assume pickle
            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "
                    "This data appears to be pickle-serialized (legacy format). To deserialize it, set "
                    "allow_pickle=True (not recommended for untrusted data)."
                )
            # Warn about insecure pickle deserialization
            import warnings

            warnings.warn(
                "Deserializing pickle data. This is a security risk if the data is untrusted.",
                FutureWarning,
                stacklevel=2,
            )
            return pickle.loads(base64.b64decode(data))

    @staticmethod
    def _extract_method_body(method) -> str:
        """Extract method body without the def line and dedent it."""
        import inspect

View on GitHub (pinned to 30bb116109)

Solutions

If trusted, pass allow_pickle=True to loads
Verify the data actually is legacy pickle (try base64-decoding and pickle.loads in a sandbox); if it is arbitrary text, fix the caller passing the wrong string
Re-serialize the artifacts in the new prefixed safe format and update storage

Example fix

# before
obj = SafeSerializer.loads(legacy_data)  # raises: legacy pickle suspected

# after
obj = SafeSerializer.loads(legacy_data, allow_pickle=True)  # trusted data only

Defensive patterns

Strategy: validation

Validate before calling

def classify(data: str) -> str:
    if data.startswith(SafeSerializer.SAFE_PREFIX): return "safe"
    if data.startswith("pickle:"): return "pickle"
    return "legacy-unknown"  # inspect before enabling allow_pickle

Type guard

def looks_like_base64_pickle(data: str) -> bool:
    import base64
    try:
        base64.b64decode(data, validate=True)
        return True
    except Exception:
        return False

Try / catch

from smolagents.serialization import SerializationError
try:
    obj = SafeSerializer.loads(data)
except SerializationError:
    obj = SafeSerializer.loads(data, allow_pickle=True)  # only after verifying provenance

Prevention

Migrate legacy artifacts to the prefixed safe format once, then keep allow_pickle=False
Record a format version alongside persisted data
Never enable allow_pickle for data received over network or from users

When it happens

Trigger: Calling loads on legacy persisted data (base64 pickle with no prefix) with allow_pickle=False, e.g. old saved agent traces loaded through convert, _get_metadata, get_tasks_to_run, or answer_questions.

Common situations: Upgrading smolagents and loading session files or cached metadata written by an older version; reading externally produced base64(pickle) blobs that lack the new prefix; strings that coincidentally aren't prefixed serialized data at all.

Related errors

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/3120ed988fa98408. Report an issue: GitHub.