diff --git a/src/ii_agent/agents/models/base.py b/src/ii_agent/agents/models/base.py
index 42805973e..263559df2 100644
--- a/src/ii_agent/agents/models/base.py
+++ b/src/ii_agent/agents/models/base.py
@@ -1158,8 +1158,13 @@ async def arun_function_calls(
                 for input_field in fc.arguments.get("user_input_fields", []):
                     field_type = input_field.get("field_type")
                     try:
+                        _SAFE_TYPES = {
+                            "str": str, "int": int, "float": float, "bool": bool,
+                            "list": list, "dict": dict, "tuple": tuple, "set": set,
+                            "bytes": bytes, "NoneType": type(None),
+                        }
                         python_type = (
-                            eval(field_type) if isinstance(field_type, str) else field_type
+                            _SAFE_TYPES.get(field_type, str) if isinstance(field_type, str) else field_type
                         )
                     except (NameError, SyntaxError):
                         python_type = str  # Default to str if type is invalid
diff --git a/src/ii_agent/agents/tools/base.py b/src/ii_agent/agents/tools/base.py
index e85a3e79c..d2d5d3360 100644
--- a/src/ii_agent/agents/tools/base.py
+++ b/src/ii_agent/agents/tools/base.py
@@ -29,9 +29,17 @@ def to_dict(self) -> Dict[str, Any]:
 
     @classmethod
     def from_dict(cls, data: Dict[str, Any]) -> "UserInputField":
+        # Use a safe type lookup instead of eval() to prevent code injection
+        _SAFE_TYPES = {
+            "str": str, "int": int, "float": float, "bool": bool,
+            "list": list, "dict": dict, "tuple": tuple, "set": set,
+            "bytes": bytes, "NoneType": type(None),
+        }
+        field_type_name = data["field_type"]
+        field_type = _SAFE_TYPES.get(field_type_name, str)
         return cls(
             name=data["name"],
-            field_type=eval(data["field_type"]),  # Convert string type name to actual type
+            field_type=field_type,
             description=data["description"],
             value=data["value"],
         )