HazardAuditor guards computer-use agents against runtime risks
Computer-use agents now act in browsers, terminals, file systems and external services, which means their safety risks show up in what they do at runtime, not just in what they say. The authors argue that existing guard models were built for static prompts and responses and are poorly suited to judging agent execution, while existing executable safety platforms only produce a pass or fail verdict for a run rather than the normalized training signal a guard model needs to learn across different agent frameworks. HazardAuditor is proposed to close both gaps at once. Its infrastructure runs heterogeneous agents, specifically Claude Code, Codex, Hermes and OpenClaw, inside controlled environments and converts their interactions into a canonical event representation, so that runs from different frameworks can supervise the same guard model. The authors also identify a training problem specific to generative guards: token-level post-training objectives let longer rationales dominate the gradient updates, distorting what the model actually optimizes for. Their proposed fix, Guard Policy Optimization (GuardPO), converts deterministic safety outcomes into sequence-level advantages and normalizes the rationale and verdict portions of the output separately, so the safety decision itself becomes the effective unit being optimized rather than an artifact of how long the model's reasoning happens to run. Tested across multiple benchmarks and multiple heterogeneous computer-use systems, HazardAuditor is reported to improve accuracy by up to 16.5 percentage points over the strongest prior guard model. The authors state that code, trained models and evaluation artifacts will be made available at a project website, without giving a release date.
Key facts
- HazardAuditor runs heterogeneous computer-use agents, including Claude Code, Codex, Hermes and OpenClaw, in controlled environments and normalizes their interactions into a canonical event representation for cross-framework guard training.
- The authors identify a structural flaw in token-level post-training for generative guard models: longer rationales come to dominate gradient updates.
- Their training method, Guard Policy Optimization (GuardPO), converts deterministic safety outcomes into sequence-level advantages and normalizes rationale and verdict regions separately, making the safety decision the effective unit of optimization.
- Across multiple benchmarks and heterogeneous computer-use systems, HazardAuditor is reported to improve accuracy by up to 16.5 percentage points over the strongest prior guard model.
- Code, trained models and evaluation artifacts are planned for release at a project website, with no release date given.
Why it matters
Guard models built for moderating static text do not transfer well to agents that act, since the risk lives in what an agent does at runtime rather than in a single generated response. Existing executable safety platforms can already run an agent and score the outcome, but that scoring is a one-off verdict, not the normalized, comparable supervision needed to train a guard model across different agent frameworks. HazardAuditor's contribution is turning execution traces from several different agent frameworks into one shared event format a guard model can actually learn from.
Who it affects
The work targets teams building or evaluating safety guard models for agentic systems, since it supplies both the infrastructure to generate cross-framework training data and a training method aimed at that specific setting. It also touches the computer-use agents used to generate the data, Claude Code, Codex, Hermes and OpenClaw, which serve as the heterogeneous execution environments the framework draws its supervision signal from.
How to use it
The authors state that code, trained models and evaluation artifacts will be published at a project website, but give no release date, so nothing is usable from the paper yet. Once available, the framework is meant to be run against computer-use agents inside controlled environments to produce the normalized event data GuardPO trains on.
How solid is it
The headline result is a reported accuracy improvement of up to 16.5 percentage points over the strongest prior guard, measured across multiple benchmarks and heterogeneous computer-use systems. The source does not name those benchmarks or identify which guard model served as the comparison point, and the figure is a peak ('up to'), not an average, so the typical improvement could be smaller.
Risks and caveats
The source text gives no author names or institutional affiliations, no specific benchmark names, no name for the 'strongest prior guard' baseline and no release date for the promised code and models, all of which limit independent verification of the claims for now. As with any self-reported benchmark result, the numbers come from the authors' own evaluation and have not yet been checked by outside replication.