HazardAuditor: From Executable Threats to Safer Computer-Use Agents

• URL: http://arxiv.org/abs/2609.15134v1
• Date: Mon, 14 Sep 2026 07:09:33 GMT
• Title: HazardAuditor: From Executable Threats to Safer Computer-Use Agents
• Abstract summary: Existing guard models target static prompts and responses.<n>Existing safety platforms produce evaluation verdicts rather than the normalized supervision a guard model needs to learn.<n>We introduce HazardAuditor, an execution-grounded framework that closes both gaps.
• Score: 50.06351661912873
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Computer-use agents increasingly interact with browsers, terminals, file systems, and external services, introducing safety risks that emerge through runtime behavior rather than generated content alone. Existing guard models target static prompts and responses and are poorly suited to agent execution; existing executable safety platforms produce evaluation verdicts rather than the normalized supervision a guard model needs to learn across heterogeneous agent frameworks. We introduce HazardAuditor, an execution-grounded framework that closes both gaps. Its infrastructure runs heterogeneous agents (Claude Code, Codex, Hermes, and OpenClaw) in controlled environments and normalizes their interactions into a canonical event representation for cross-framework supervision. We further observe that token-level post-training objectives create a structural mismatch for generative guards, causing longer rationales to dominate gradient updates. Guard Policy Optimization (GuardPO) addresses this by converting deterministic safety outcomes into sequence-level advantages and normalizing rationale and verdict regions, making the safety decision the effective unit of optimization. Across multiple benchmarks and heterogeneous computer-use systems, HazardAuditor improves accuracy by up to 16.5 percentage points over the strongest prior guard. Code, models, and evaluation artifacts will be available at https://yunhao-feng.github.io/HazardAuditor/.

Related papers

• BraveGuard: From Open-World Threats to Safer Computer-Use Agents [68.38397514360227]
  BraveGuard is a self-evolving defense framework for training guard models from open-world threat signals and realistic agent trajectories.<n>We instantiate BraveGuard by training multiple guard backbones, including Qwen3-Guard and Llama-Guard variants, and evaluate the resulting guards on trajectory-level agent-safety benchmarks.
  arXiv  Detail & Related papers  (2026-05-31T11:16:18Z)
• AgentDoG 1.5: A Lightweight and Scalable Alignment Framework for AI Agent Safety and Security [147.50046962090795]
  We propose a lightweight and scalable agent safety alignment framework.<n>We update the agent safety taxonomy to accommodate emergent risks from Codex and OpenClaw execution scenarios.<n>Based on AgentDoG 1.5, we construct a highly efficient agentic safety SFT and RL training environment.<n>We deploy AgentDoG 1.5 as a training-free online guardrail for real-time safety moderation.
  arXiv  Detail & Related papers  (2026-05-28T11:48:37Z)
• Position: AI Safety Requires Effective Controllability [7.789894640525689]
  We argue that AI safety requires controllability as a first-class objective.<n>Experiments with OpenClaw-based agents show that current alignment and guardrail mechanisms reduce risk, but often fail to provide persistent, authoritative, and enforceable runtime control.
  arXiv  Detail & Related papers  (2026-05-26T14:53:24Z)
• SafeHarbor: Hierarchical Memory-Augmented Guardrail for LLM Agent Safety [10.846727385398589]
  Malicious actors can manipulate Large Language Model (LLM) agents into executing tools to generate harmful content.<n>textscSafeHarbor is a novel framework designed to establish precise decision boundaries for LLM agents.<n>textscSafeHarbor achieves state-of-the-art performance on both ambiguous benign tasks and explicit malicious attacks.
  arXiv  Detail & Related papers  (2026-05-07T05:50:45Z)
• SafeAgent: A Runtime Protection Architecture for Agentic Systems [4.4767259565994495]
  This paper presents SafeAgent, a runtime security architecture that treats agent safety as a stateful decision problem.<n>The proposed design separates execution governance from semantic risk reasoning through two coordinated components.<n> Experiments on Agent Security Bench (ASB) and InjecAgent show that SafeAgent consistently improves robustness over baseline and text-level guardrail methods.
  arXiv  Detail & Related papers  (2026-04-19T18:02:21Z)
• CORA: Conformal Risk-Controlled Agents for Safeguarded Mobile GUI Automation [68.53387633351484]
  We propose CORA (COnformal Risk-controlled GUI Agent), a post-policy, pre-action safeguarding framework that provides statistical guarantees on harmful executed actions.<n> CORA reformulates safety as selective action execution: we train a Guardian model to estimate action-conditional risk for each proposed step.<n>To rigorously evaluate this paradigm, we introduce Phone-Harm, a new benchmark of mobile safety violations with step-level harm labels.
  arXiv  Detail & Related papers  (2026-04-10T09:41:21Z)
• AgentHazard: A Benchmark for Evaluating Harmful Behavior in Computer-Use Agents [31.649268608215817]
  We present textbfAgentHazard, a benchmark for evaluating harmful behavior in computer-use agents.<n>We evaluate Claude Code, OpenClaw, and IFlow using mostly open or openly deployable models from the Qwen3, Kimi, GLM, and DeepSeek families.
  arXiv  Detail & Related papers  (2026-04-03T10:29:31Z)
• ReasAlign: Reasoning Enhanced Safety Alignment against Prompt Injection Attack [52.17935054046577]
  We present ReasAlign, a model-level solution to improve safety alignment against indirect prompt injection attacks.<n>ReasAlign incorporates structured reasoning steps to analyze user queries, detect conflicting instructions, and preserve the continuity of the user's intended tasks.
  arXiv  Detail & Related papers  (2026-01-15T08:23:38Z)
• DRIFT: Dynamic Rule-Based Defense with Injection Isolation for Securing LLM Agents [52.92354372596197]
  Large Language Models (LLMs) are increasingly central to agentic systems due to their strong reasoning and planning capabilities.<n>This interaction also introduces the risk of prompt injection attacks, where malicious inputs from external sources can mislead the agent's behavior.<n>We propose a Dynamic Rule-based Isolation Framework for Trustworthy agentic systems, which enforces both control and data-level constraints.
  arXiv  Detail & Related papers  (2025-06-13T05:01:09Z)
• LlamaFirewall: An open source guardrail system for building secure AI agents [0.5603362829699733]
  Large language models (LLMs) have evolved from simple chatbots into autonomous agents capable of performing complex tasks.<n>Given the higher stakes and the absence of deterministic solutions to mitigate these risks, there is a critical need for a real-time guardrail monitor.<n>We introduce LlamaFirewall, an open-source security focused guardrail framework.
  arXiv  Detail & Related papers  (2025-05-06T14:34:21Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.