huggingface/smolagents · error · SerializationError

Unknown final answer format: expected 'safe:' or 'pickle:' p

Error message

Unknown final answer format: expected 'safe:' or 'pickle:' prefix

What it means

SerializationError raised when the encoded final answer string does not start with 'safe:' or 'pickle:'. The deserializer cannot determine the format, so it fails closed rather than guessing.

Source

Thrown at src/smolagents/remote_executors.py:332

        Args:
            encoded_value (`str`): Serialized string from FinalAnswerException.
            allow_pickle (`bool`, default `False`): Whether to allow pickle deserialization.

        Returns:
            `Any`: Deserialized Python object.

        Raises:
            SerializationError: If pickle data is rejected.
        """
        if encoded_value.startswith("safe:"):
            json_data = json.loads(encoded_value[5:])
            return SafeSerializer.from_json_safe(json_data)
        elif encoded_value.startswith("pickle:"):
            if not allow_pickle:
                raise SerializationError("Pickle data rejected: allow_pickle=False")
            return pickle.loads(base64.b64decode(encoded_value[7:]))
        else:
            raise SerializationError("Unknown final answer format: expected 'safe:' or 'pickle:' prefix")


class E2BExecutor(RemotePythonExecutor):
    """
    Remote Python code executor in an E2B sandbox.

    Args:
        additional_imports (`list[str]`): Additional Python packages to install.
        logger (`Logger`): Logger to use for output and errors.
        allow_pickle (`bool`, default `False`): Whether to allow pickle serialization for objects that cannot be safely serialized to JSON.
            - `False` (default, recommended): Only safe JSON serialization is used. Raises error if object cannot be safely serialized.
            - `True` (legacy mode): Tries safe JSON serialization first, falls back to pickle with warning if needed.

            **Security Warning:** Pickle deserialization can execute arbitrary code. Only set `allow_pickle=True`
            if you fully trust the execution environment and need backward compatibility with custom types.
        **kwargs: Additional keyword arguments to pass to the E2B Sandbox instantiation.
    """

View on GitHub (pinned to 30bb116109)

Solutions

1. Ensure the same smolagents version runs on host and inside the sandbox/Docker image (rebuild the image)
2. Don't raise FinalAnswerException-like errors manually with arbitrary payloads
3. Upgrade both sides to a current version, then retry

def has_known_prefix(encoded: str) -> bool:
    return encoded.startswith("safe:") or encoded.startswith("pickle:")

from smolagents.remote_executors import SerializationError

try:
    value = RemotePythonExecutor._deserialize_final_answer(encoded, allow_pickle)
except SerializationError as e:
    if "prefix" in str(e):
        # version mismatch between sandbox and host
        rebuild_or_reinstall_sandbox_env()
    raise

When it happens

Trigger: A FinalAnswerException payload reaching _deserialize_final_answer whose evalue is raw JSON, plain text, or was produced by a different smolagents version with another prefix scheme.

Common situations: Version mismatch between the package running inside the sandbox and the host; manual/crafted exceptions carrying arbitrary strings; user code raising exceptions whose message collides with the final-answer mechanism.

Related errors

• Pickle data rejected: allow_pickle=False
• Unknown model class '{model_info['class']}'. Supported model
• Unknown agent class '{managed_agent_dict['class']}'. Support
• If you want to return an answer, please do not perform any o
• You returned multiple final answers. Please return only one

AI-assisted analysis of huggingface/smolagents@30bb116109 (2026-08-28). Data as JSON: /api/errors/c1a5a68f3972dc2b. Report an issue: GitHub.