smolagents 1.26.0

Apply the Python 3 baseline first. These rules cover smolagents 1.26.0 on a maintained Python release satisfying Python >=3.10; verify compatibility of the chosen model, MCP, UI, and executor extras with that interpreter. Confine CodeAgent's intentional execution of model-authored Python to the isolated execution boundary below.

Agent configuration and model boundaries

• Keep instructions, prompt_templates, tools, managed_agents, and executor settings in trusted application configuration. Leave add_base_tools=False unless every added capability is needed; enabling it also gives a ToolCallingAgent the local PythonInterpreterTool.
• Treat tasks, retrieved pages, tool observations, errors, memory, and managed-agent reports as untrusted data even when included in later planning or model messages. Do not let their instructions change tool permissions or application policy.
• Fix model IDs, providers, base_url/api_base, credentials, and client_kwargs in server configuration. Authorize the actual recipient of prompts and tool results, including every fallback in LiteLLMRouterModel; do not let callers redirect an authenticated model client.
• Review custom_role_conversions and flatten_messages_as_text for the selected model adapter. Test the outgoing messages so user or tool content is never promoted into trusted instructions through role conversion or concatenation.
• Pass only necessary agent-visible data through run(additional_args=...): values are stringified into the task, merged into agent.state, and sent to a code executor. Never pass