Agno PandasTools checked its result after it had already called unsafe pandas code

Agno's create_pandas_dataframe helper accepted a function selector and invoked a corresponding pandas method using dynamic attribute lookup. A reported issue shows why checking the returned object's type was too late. By the time the function returned, a model-influenced choice such as read_pickle might already have deserialized attacker-controlled data and executed its unsafe processing path.

The condition requires an enabled PandasTools helper and influence over the function name and arguments. It is not evidence that ordinary chat messages trigger remote code execution on every Agno deployment. The source describes the affected code path but does not establish a verified fixed release or known production victim. The reported issue and case dossier preserve those limits.

The immediate control belongs before dynamic dispatch: restrict the set of callable constructors to explicit safe names, verify arguments and apply filesystem or network restrictions independently. A test that only confirms the output is a DataFrame cannot rule out side effects of a constructor that already ran.