The popular agent framework's PandasTools runs getattr(pd, create_using_function)(**function_parameters) with both values taken from the model's tool call, and only checks that the result is a DataFrame after the call. An agent that reads attacker-influenced text can be steered into pandas.read_pickle on a remote or local file (code execution via pickle), or read_csv/read_json on any local path to leak files back to the model. A second sink, run_dataframe_operation, dispatches any DataFrame method the same way, including query/eval and to_pickle. Both tools are on by default. VulnCheck lists Agno through 3.1.11 as affected; the issue was filed July 2 and is still open, and the pandas tool code has not changed in the 3.1.12 release (Oct 29).

What to do: if you use PandasTools, disable enable_create_pandas_dataframe and enable_run_dataframe_operation or wrap them with an allowlist of functions (for example only read_csv on a fixed directory), and do not give the tool to agents that read web pages, email, tickets or other untrusted content. The general lesson: a tool that lets the model name the function is a code-execution tool.