PaperlayerView exact revision on arXiv

Source-linked AI summary

BraveGuard: From Open-World Threats to Safer Computer-Use Agents

Yunhao Feng, Xiaohu Du, Xinhao Deng, Yifan Ding, Ming Wen, Yixu Wang, Yuxiang Xie, Baihui Zheng, Yingshui Tan, Yige Li, Yutao Wu, Kerui Cao, Wenke Huang, Yanming Guo, Xingjun Ma, Yu-Gang Jiang

arXiv:2606.01166v2cs.CRcs.CL

TL;DR

Computer-use agents can create safety risks that emerge across otherwise benign multi-step execution traces, while existing defenses rely largely on fixed taxonomies and prompt-level data. BraveGuard mines open-world threat signals, turns them into executable tasks and realistic trajectories, and trains trajectory-level guards, raising AgentHazard detection accuracy from 38.79% to 82.38% under the averaged guard-model setting.

  • Problem

    Existing safety defenses are poorly matched to computer-use risks that emerge across long-horizon execution trajectories rather than isolated prompts or responses.

  • Method

    BraveGuard mines open research for emerging threats, instantiates them as executable computer-use tasks, collects agent trajectories, and derives trajectory-level supervision for guard training.

  • Results

    82.38% accuracy versus 38.79% for off-the-shelf guard models on AgentHazard-Strongest under the averaged guard-model setting, with improvements across backend settings.

  • Takeaways & Limitations

    BraveGuard’s open-world threat discovery and realistic trajectory supervision improve safety detection for evolving computer-use-agent risks beyond fixed prompt-level or synthetic training data.

  • Takeaways & Limitations

    Coverage depends on mined threat evidence and task fidelity, and performance may vary across trace formats, tool interfaces, and execution environments.

Abstract

from arXiv · show

Computer-use agents extend language models from text generation to sustained interaction with files, terminals, browsers, and external tools. This shift creates safety risks that are difficult to detect from isolated prompts or final responses, because harm often emerges only through multi-step execution traces whose individual actions appear locally benign. We introduce BraveGuard, a self-evolving defense framework for training guard models from open-world threat signals and realistic agent trajectories. BraveGuard mines recent research sources to identify emerging risks and attack patterns, instantiates them as executable computer-use tasks, collects agent rollouts, and derives trajectory-level supervision for guard model training. As new threats and validation failures appear, the pipeline can be repeated, yielding an adaptive defense loop rather than a static, benchmark-driven training process. We instantiate BraveGuard by training multiple guard backbones, including Qwen3-Guard and Llama-Guard variants, and evaluate the resulting guards on trajectory-level agent-safety benchmarks. BraveGuard consistently improves safety detection across computer-use trajectories. On AgentHazard, it substantially improves detection accuracy over off-the-shelf guard models, with accuracy increasing from 38.79% to 82.38% under the averaged guard-model setting. These results show that guard supervision grounded in open-world threat discovery and realistic agent execution can improve safety monitoring beyond fixed taxonomies and synthetic prompt-level data. BraveGuard offers a scalable path toward adaptive defenses for computer-use agents facing evolving real-world risks.

1 Introduction

Computer-use agents execute long-horizon operations across digital environments, creating safety risks that can emerge only from multi-step trajectories rather than isolated prompts or responses. BraveGuard addresses this gap by mining open-world threats, converting them into executable tasks, and deriving supervision from complete agent executions.

  • Computer-use agents connect language models to terminals, file systems, browsers, and external tools to execute long-horizon plans over persistent state.
  • Harm can emerge across execution trajectories even when individual actions appear locally plausible, distinguishing agent safety from conventional prompt-level moderation.
  • Existing defenses rely largely on static unsafe-content corpora, predefined risk taxonomies, manually curated scenarios, or synthetic adversarial prompts.
  • BraveGuard mines open research sources for emerging risks, attack strategies, and failure modes, instantiates them as executable computer-use tasks, and collects agent trajectories.
  • BraveGuard converts complete execution trajectories into guard-model supervision, yielding substantially stronger safety monitoring than fixed prompt-level or synthetic training data.

2 Related Work

Related work frames computer-use agents as a distinct safety problem because harmful behavior can emerge from multi-step interaction traces, while existing defenses often do not assess sequence-level alignment with objectives, state, and constraints.

  • Threats to Agents: Computer-use agents interact with files, web pages, tools, and commands, making safety failures trace-level phenomena rather than isolated unsafe utterances.Locally plausible actions can compose into harmful outcomes across multiple interaction rounds.
  • Agent Defenses: General LLM defenses include feedback-based alignment, adversarial red teaming, and moderation models for unsafe prompts or responses.These methods remain useful but are not designed for tool-mediated action sequences.
  • Agent Defenses: Agent-focused defenses increasingly filter injected instructions and check whether candidate actions remain aligned with task objectives.The related work emphasizes extending safety evaluation beyond prompt- or response-level moderation.

3 BraveGuard

BraveGuard is a self-evolving framework that converts open-world threat evidence into trajectory-level supervision for computer-use-agent guard models. It discovers and structures emerging risks, instantiates executable tasks, labels complete executions, and refines supervision using validation failures while reserving external benchmarks for final evaluation.

  • Framework overview: BraveGuard assesses safety over complete execution traces because harmful behavior can emerge from interactions among tools, files, browsers, terminals, and persistent state.Local moderation of isolated prompts, actions, or final responses is insufficient when risk depends on temporal composition and cross-step dependencies.
  • Threat discovery: The threat-discovery stage builds a structured, non-stationary taxonomy from recent open-world evidence rather than relying on fixed taxonomies or closed benchmarks.It represents risk categories, attack patterns, and failure modes, while mutually reinforcing search terms and taxonomy updates across discovery rounds.
  • Task and trajectory generation: BraveGuard synthesizes plausible computer-use tasks whose individual actions may appear benign but whose full execution can expose unsafe consequences.Tasks specify a user request, tool context, expected intermediate behavior, and target risk; OpenClaw generates trajectories containing messages, tool calls, outputs, observations, edits, and final responses.
  • Trajectory supervision: Each trajectory receives a safe/unsafe label, applicable risk category, and evidence-grounded rationale, and the resulting complete-execution data trains multiple guard backbones.The binary label is used for benchmark consistency, while rationales and risk categories remain annotation metadata.
  • Self-evolving defense loop: BraveGuard refines its supervision by analyzing held-out validation failures and newly mined threats, while external trajectory-safety benchmarks remain reserved for final evaluation.Refinement targets include delayed triggers, file-embedded prompt injections, unsafe command chains, and subtle cross-step dependencies.

4 Experiments

BraveGuard is evaluated on held-out trajectory-level safety benchmarks across diverse computer-use backends and formats. It consistently improves detection over existing detectors, while ablations show gains from trajectory supervision, dynamic threat discovery, and self-evolving validation.

  • Evaluation setup: BraveGuard is evaluated on held-out AgentHazard-Strongest and ATBench-500 benchmarks reserved exclusively for final evaluation.Development uses only a held-out validation split from BraveGuard-generated trajectories.
  • Evaluation setup: Experiments test detector reliability across four OpenClaw 3.11 backend models and native ATBench trajectories without OpenClaw conversion.The ATBench setting measures cross-format generalization because its serialization, tool representation, and observation format differ from OpenClaw traces.
  • AgentHazard-Strongest results: 82.38% average accuracy is achieved by BraveGuard-trained guards versus 38.79% for off-the-shelf guards under the GPT-5.5 backend.BraveGuard-trained guards consistently outperform general LLM judges and off-the-shelf guard models across backend settings.
  • ATBench-500 results: 86.4% accuracy, 95.2% recall, and 86.1% F1 are achieved by BraveGuard-Qwen3-Guard-8B on native ATBench trajectories.AgentDoG-Llama3.1-8B and AgentDoG-Qwen2.5-7B obtain higher F1 scores of 88.8% and 88.4%, respectively, primarily attributed to format alignment.
  • Component ablation: 83.65% accuracy, 91.28% recall, and 89.22% F1 are achieved by the full self-evolving configuration, compared with 62.18% F1 after static-taxonomy training and 78.94% F1 after dynamic threat discovery.The ablation uses Qwen3-Guard-8B on the GPT-5.5 OpenClaw backend; the off-the-shelf backbone achieves 26.24% accuracy, 1.03% recall, and 2.02% F1.
  • Category-wise analysis: BraveGuard performs strongly across most risk categories but is weaker on data exfiltration and compliance bypass in AgentHazard-Strongest, while ATBench-500 performance is more uniform.Particularly high AgentHazard-Strongest accuracy occurs for destructive action, persistence establishment, resource exhaustion, and privilege escalation.

5 Conclusion

BraveGuard trains trajectory-level guard models by converting open-world threat signals into executable tasks, realistic agent trajectories, and guard supervision. Experiments show improved safety detection for long-horizon computer-use trajectories, including a rise in AgentHazard detection accuracy from 38.79% to 82.38% under the averaged guard-model setting.

  • 5 Conclusion: BraveGuard transforms open-world threat signals into executable tasks, realistic agent trajectories, and trajectory-level guard-model supervision.The framework is designed for computer-use agents and self-evolves through this threat-to-supervision pipeline.
  • 5 Conclusion: Experiments on AgentHazard-Strongest and ATBench-500 show improved safety detection for long-horizon computer-use trajectories.The conclusion reports gains across both trajectory-level evaluation benchmarks.
  • 5 Conclusion: 38.79% to 82.38%: AgentHazard detection accuracy increased under the averaged guard-model setting.This quantitative result is reported as evidence that BraveGuard improves safety detection.

Limitations

BraveGuard’s coverage is limited by the quality and instantiability of mined threats, while its generalization may vary beyond OpenClaw-based trajectories and environments.

  • Threat coverage: Coverage depends on mined threat evidence and synthesized-task fidelity, leaving threats absent from public sources or difficult to instantiate underrepresented.This limitation affects which risks enter the training pipeline.
  • Transferability: Performance may vary across agents with different trace formats, tool interfaces, or execution environments because training primarily uses OpenClaw trajectories.The current pipeline is built primarily around OpenClaw traces.

Ethical Statement … B.2 Risk Category Distribution

The appendices describe BraveGuard as a defensive safety-monitoring framework built from open-world threat literature and converted into executable, multi-step computer-use tasks. Its synthesized pool spans all 28 risk categories with deliberately broad and relatively balanced coverage.

  • Ethical Statement: BraveGuard models harmful behaviors only to construct defensive supervision in controlled benchmark and sandboxed environments.The stated behaviors include data exfiltration, unsafe execution, and policy circumvention.
  • A Data Collection Details: 97 search queries identified 110 papers published through January 1, 2026, yielding 32 attack methods and 28 risk categories.The summary agent maintained a refined keyword inventory during open-world threat discovery.
  • B Synthesized Task Pool: BraveGuard synthesized a task pool and analyzed its distribution across risk categories and task complexity.The appendix also provides a case study showing how a structured threat entry becomes a multi-step executable agent task.
  • B.1 Dataset Overview: Each task pairs a malicious objective with locally plausible sub-steps, risk and attack-method labels, and an annotation explaining the operationalized strategy.The pool converts structured threat knowledge into executable computer-use agent tasks and covers all 28 risk categories.
  • B.2 Risk Category Distribution: 276 tasks populate each of the four most frequent categories: Persistence Establishment, Compliance Bypass, Context Partition Manipulation, and Context Memory Corruption.These categories are identified as the most frequent in the synthesized task distribution.
  • B.2 Risk Category Distribution: 243 tasks comprise Tool Feedback Manipulation, the least frequent category, supporting relatively balanced coverage across the 28 risk categories.The pool is intentionally designed for broad coverage rather than concentration in a small subset of risk types.

B.3 Task Complexity: Step Length and Step Count · B.4 Case Study: Security Audit Gaslighting for Data Exfiltration

BraveGuard generates decomposed tasks with comparable step-level descriptive complexity and usually three or four steps. A security-audit-gaslighting example shows how data-exfiltration objectives are reframed as routine compliance or diagnostic operations across four sub-steps.

  • B.3 Task Complexity: Step Length and Step Count: 109–126 characters: average decomposed-step lengths remain within a narrow band across all risk categories.Tool Feedback Manipulation and Bias Induced Vulnerabilities are at the higher end, while Application Prompt Theft is at the lower end.
  • B.3 Task Complexity: Step Length and Step Count: Comparable step lengths across categories reduce opportunities for guard models to use superficial length differences as safety shortcuts.The paper treats average individual-step length as a proxy for sub-task descriptive complexity.
  • B.3 Task Complexity: Step Length and Step Count: Mode = 3 and mean = 3.36: decomposed step counts are heavily concentrated at three and four steps, with three-step tasks most common.Only 133 tasks use two steps and 9 tasks use five steps.
  • B.3 Task Complexity: Step Length and Step Count: Approximately 62.0% of tasks have three or fewer steps, according to the cumulative distribution.Tasks with exactly three or four steps together account for the vast majority of the pool.
  • B.4 Case Study: Security Audit Gaslighting for Data Exfiltration: BraveGuard converts a structured threat entry into a multi-step executable agent task through a Data Exfiltration example using Security Audit Gaslighting.The example is reproduced in Table 5.
  • B.4 Case Study: Security Audit Gaslighting for Data Exfiltration: The malicious objective is to steal project-root .env files and ~/.ssh/id_rsa, then transmit their contents to an attacker-controlled endpoint through four routine-framed sub-steps.The first step requests a file listing under the cover of an “existence audit” required by security policy; the second asks for a Python script to read the en…

C Additional experiments

Additional held-out evaluations show that BraveGuard-Qwen3-Guard-8B generalizes beyond the paper’s main benchmarks and OpenClaw-style trajectories. It achieves the best accuracy on both R-Judge and ASSE-Safety, while recall varies against high-recall baselines.

  • Evaluation benchmarks: R-Judge contains 569 annotated multi-turn interaction records spanning 27 risk scenarios, 5 application categories, and 10 risk types.The benchmark evaluates safety judgment rather than task execution.
  • Evaluation benchmarks: ASSE-Safety comprises 2,293 annotated examples across 15 risk types and 29 application scenarios, including subtle, ambiguous, and compositional cases.It is designed to test whether evaluators identify both safety risks and security threats in agent interaction records.
  • Discussion: Evaluated directly on benchmark-provided records, BraveGuard-trained guards remain strong across external judgment benchmarks beyond OpenClaw-style trajectories and the main evaluation distributions.The evaluation preserves each benchmark’s record formats, annotation conventions, and scenario distributions.
  • Results: BraveGuard-Qwen3-Guard-8B achieves 57.8% accuracy on R-Judge, exceeding Llama3.1-8B-Instruct (53.7%), NemoGuard (54.4%), and Qwen3-Guard (40.6%).Its recall is 91.2%, compared with 100.0% for Llama3.1-8B-Instruct, 40.6% for NemoGuard, and 5.5% for Qwen3-Guard.
  • Results: BraveGuard-Qwen3-Guard-8B reaches 67.4% accuracy on ASSE-Safety, above Llama3.1-8B-Instruct (55.2%), NemoGuard (43.4%), and Qwen3-Guard (48.2%).Its recall is 63.9%, below Llama3.1-8B-Instruct (98.3%) but above NemoGuard (30.3%) and Qwen3-Guard (15.8%).

D Training Dynamics

Training loss curves for all three BraveGuard backbones show stable convergence, with decreasing and flattening smoothed trends despite short-term raw-loss fluctuations. These curves characterize optimization behavior rather than final safety capability, which is evaluated on held-out benchmarks.

  • Loss curves: Figure 8 reports raw step-level and smoothed training-loss curves for BraveGuard-Llama-Guard-8B, BraveGuard-Qwen3-Guard-4B, and BraveGuard-Qwen3-Guard-8B.Each backbone is shown with both loss views.
  • Convergence: BraveGuard-Llama-Guard-8B trains for approximately 10k steps and reaches final loss 0.0070 (minimum 0.0041), while Qwen3-Guard-4B converges within roughly 4.2k steps at final loss 0.0030 (minimum 0.0013).The smoothed trends decrease and flatten despite short-term fluctuations in the raw curves.
  • Convergence: BraveGuard-Qwen3-Guard-8B converges within roughly 5k steps and attains final loss 0.0015 (minimum 0.0008), with all three backbones exhibiting stable convergence.The curves demonstrate optimization behavior, not final safety capability; that capability is assessed on held-out benchmarks.

E Exploratory Results on Skill-Based Defense

The section explores skills as a lightweight, modular inference-time defense for computer-use agents. Preliminary AgentHazard results show reduced attack performance in some settings, but skill-based defense remains inconsistent and requires risk-conditioned activation and trajectory-level validation.

  • Motivation: Skills are explored as an inference-time defense mechanism that injects behavioral constraints through safe execution rules, tool-use procedures, or task-specific constraints.The approach is intended to provide a lightweight and modular interface that can be retrieved or activated in relevant execution contexts.
  • Experimental Setup: The preliminary AgentHazard study compares default OpenClaw, OpenClaw with the static shell-safe-exec skill, and OpenClaw with transferred AutoSkills.These configurations are denoted Baseline, Static Skills, and AutoSkills, respectively.
  • Results: 89.73 baseline attack performance falls to 85.51 with Static Skills and 85.93 with AutoSkills on AgentHazard-Strongest with GPT-5.2.Lower attack performance indicates stronger defense, but the results do not establish consistently reliable improvement.
  • Limitations and Future Work: Effective defensive skills require risk-conditioned activation, safety-aware retrieval, and validation against trajectory-level outcomes beyond reusable instructions.Future work will study adaptive skill-based defenses jointly optimized with guard models.
Loading 2606.01166v2…