Patched code sample

import ast
import pandas as pd

# Blocklist of dangerous pandas functions that can perform I/O or code execution.
DANGEROUS_PANDAS_FUNCTIONS = {
    'read_csv', 'read_json', 'read_excel', 'read_sql', 'read_html',
    'read_pickle', 'to_pickle', 'eval'
}

def execute_agent_code(code: str, df: pd.DataFrame):
    """
    Executes python code generated by an LLM to manipulate a DataFrame.
    The code is validated by parsing it into an AST first.
    """
    tree = ast.parse(code)

    # FIX: The code is parsed into an AST. Calls to pandas I/O functions
    # are explicitly blocked to prevent data exfiltration or SSRF.
    for node in ast.walk(tree):
        if (isinstance(node, ast.Call) and
                isinstance(node.func, ast.Attribute) and
                isinstance(node.func.value, ast.Name) and
                node.func.value.id == 'pd' and
                node.func.attr in DANGEROUS_PANDAS_FUNCTIONS):
            raise ValueError(f"Disallowed pandas function call: {node.func.attr}")

    # The 'pd' object is made available to the executed code.
    # A safe alternative would use a sandboxed execution environment.
    exec(code, {"df": df, "pd": pd})
    return df