HazardAuditor Unifies Trajectories from Four Computer-Use Agents and Trains a Safety Gatekeeper with Sequence-Level Rewards

The risks posed by computer-use agents usually lie not in a single line of text, but in the complete sequence of actions formed by reading files, executing commands, and calling external services. Researchers from Ant Group and other organizations introduced HazardAuditor, which runs Claude Code, Codex, Hermes, and OpenClaw in controlled environments and normalizes each framework’s prompts, reasoning, tool parameters, and environment responses into a shared trajectory-event format. After reading the full record, the guard model first generates an auditable rationale and then outputs a definitive `safe` or `unsafe` label. Cases containing malicious text in which the agent refuses to act are not automatically classified as unsafe.

The key training innovation is Guard Policy Optimization. Conventional token-level SFT or policy updates cause longer analysis passages to accumulate more gradient, which can teach a model to write lengthy rationales without necessarily improving its final safety judgment. GuardPO converts deterministic outcomes produced by executable environments into sequence-level advantages and normalizes the rationale and verdict regions separately, making the entire safety decision—not individual tokens—the effective unit of optimization.

The project reports that on CUA-Exec, which balances safe and unsafe trajectories, the SFT model achieved 80.50% accuracy, rising to 90.88% after GuardPO was added. Compared with the strongest existing guard listed in the study, performance improved by 12.5, 4.0, 9.5, and 16.5 percentage points on the Claude Code, Codex, Hermes, and OpenClaw subsets, respectively. The researchers also report approximately 87.6% to 91.5% accuracy on external benchmarks including AgentHazard, R-Judge, ASSE-Safety, and ATBench.

The code, 8B checkpoint, and SFT and GuardPO recipes have been released. The inference engine also marks trajectories as untrusted data, and unparseable output returns an empty label rather than defaulting to safe. However, the repository does not include the research trajectories, per-example predictions, or training outputs, so outside researchers cannot yet fully recompute the results. More importantly, HazardAuditor is a post hoc trajectory classifier and cannot reverse side effects that have already occurred. Production systems still require least-privilege access, pre-execution policies, sandboxed environments, and human confirmation.