huggingface/smolagents · error · SerializationError

Pickle data rejected: allow_pickle=False requires safe-only

Error message

Pickle data rejected: allow_pickle=False requires safe-only data. This data is pickle-serialized. To deserialize it, set allow_pickle=True (not recommended for untrusted data).

What it means

SafeSerializer.loads was given a string with the explicit 'pickle:' prefix while allow_pickle defaults to False. The library refuses to deserialize pickle payloads unless you opt in, because pickle.loads on untrusted data leads to arbitrary code execution. The message tells you the data is explicitly pickle-formatted and you must pass allow_pickle=True.

Source

Thrown at src/smolagents/serialization.py:316

        Args:
            data: Serialized string (with "safe:" or "pickle:" prefix)
            allow_pickle: If False (default), reject pickle data (strict safe mode).
                         If True, accept both safe and pickle formats.

        Returns:
            Deserialized object

        Raises:
            SerializationError: If pickle data received but allow_pickle=False
        """
        if data.startswith(SafeSerializer.SAFE_PREFIX):
            json_data = json.loads(data[len(SafeSerializer.SAFE_PREFIX) :])
            return SafeSerializer.from_json_safe(json_data)
        elif data.startswith("pickle:"):
            # Explicit pickle prefix
            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "
                    "This data is pickle-serialized. To deserialize it, set "
                    "allow_pickle=True (not recommended for untrusted data)."
                )
            # Warn about insecure pickle deserialization
            import warnings

            warnings.warn(
                "Deserializing pickle data. This is a security risk if the data is untrusted.",
                FutureWarning,
                stacklevel=2,
            )
            return pickle.loads(base64.b64decode(data[7:]))
        else:
            # No prefix - legacy format, assume pickle
            if not allow_pickle:
                raise SerializationError(
                    "Pickle data rejected: allow_pickle=False requires safe-only data. "

View on GitHub (pinned to 30bb116109)

Solutions

1. If the data is trusted (you produced it), call SafeSerializer.loads(data, allow_pickle=True)
2. Prefer re-serializing the original objects in the safe JSON format (dumps without falling into pickle) and drop the pickle payload
3. If data may be untrusted, do not enable pickle; regenerate or reconstruct the data safely

Example fix

# before
obj = SafeSerializer.loads(data)  # raises: pickle-prefixed data

# after
obj = SafeSerializer.loads(data, allow_pickle=True)  # only for trusted data

def safe_load(data: str, trusted: bool):
    if data.startswith("pickle:") and not trusted:
        raise ValueError("Refusing untrusted pickle payload")
    return SafeSerializer.loads(data, allow_pickle=trusted)

def is_safe_prefixed(data: str) -> bool:
    return data.startswith(SafeSerializer.SAFE_PREFIX)

from smolagents.serialization import SerializationError
try:
    obj = SafeSerializer.loads(data)
except SerializationError as e:
    if "allow_pickle" in str(e) and data_is_trusted(data):
        obj = SafeSerializer.loads(data, allow_pickle=True)
    else:
        raise

When it happens

Trigger: Calling loads (directly or via convert, _get_metadata, get_tasks_to_run, process_images_and_text, answer_questions, get_json_schema) on data produced by dumps with the pickle fallback, without setting allow_pickle=True.

Common situations: Loading agent state/logs saved by an older run where objects fell back to pickle; round-tripping data between processes where one side serialized with pickle fallback; migrating serialized artifacts after a library upgrade that added the safe/pickle prefix scheme.

Related errors

• Falling back to insecure pickle serialization. This is a sec
• Deserializing pickle data. This is a security risk if the da
• Cannot serialize object: {e}
• Pickle data rejected: allow_pickle=False requires safe-only
• Unknown model class '{model_info['class']}'. Supported model

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/fe4d5f59417f194c. Report an issue: GitHub.