BraveGuard: From Open-World Threats to Safer Computer-Use Agents

When AI agents begin interacting with computers, they move beyond simple text generation. They execute sequences of actions in terminals, browsers, and file systems. This transition introduces a fundamental safety problem. Harm often emerges not from a single malicious prompt, but from a multi-step execution trajectory (the chronological sequence of an agent's actions). In these paths, each individual action may appear locally benign.

Current safety defenses are largely built for chatbots. They focus on intercepting unsafe prompts or toxic responses. However, for a computer-use agent, a sequence of legitimate-looking commands can be dangerous. For example, inspecting a config file, encoding a string, and then performing a POST request (sending data to a web server) can combine into a catastrophic data exfiltration event. This paper introduces BraveGuard, a framework designed to bridge this gap. It trains guard models on entire execution traces rather than isolated strings.

The failure of prompt-level moderation

Standard LLM safety relies on moderation models. These scan inputs and outputs for violations. This works for conversational AI, where the risk is contained within the dialogue. But as shown in, computer-use agents operate over a much larger attack surface. This involves tools, files, and persistent environments.

In these settings, the danger is temporal and compositional. An agent might perform a series of "locally plausible" actions. It might search for a file, read its contents, and then modify a dependency. Collectively, these can result in a sandbox escape (breaking out of a restricted computing environment) or unauthorized data access. Existing guard models are typically trained on static corpora of short, synthetic, or prompt-level adversarial examples. Consequently, they lack the reasoning capacity to evaluate how tool-mediated actions interact over time. They essentially try to solve a long-horizon security problem with a single-frame snapshot.

A self-evolving defense loop

BraveGuard shifts the focus from prompt-level filtering to trajectory-level supervision. The architecture is built as a closed-loop system. This helps it avoid the trap of static, benchmark-driven training. The process follows four main stages:

1. Open-World Threat Discovery: Instead of relying on a fixed taxonomy (a structured classification system), a discovery agent mines open research sources. It looks at arXiv and security reports to identify emerging risks. It organizes these into a structured taxonomy $z$. This includes a risk category ($\kappa$), an attack pattern ($\alpha$), and a failure mode ($\mu$).
2. Attack Synthesis: The framework translates these threat entries into executable computer-use tasks. Each task $\tau$ defines a user request and a sequence of sub-steps. These steps are designed to trigger a specific risk while appearing benign at the individual step level.
3. OpenClaw Rollout: The system executes these tasks using the OpenClaw agent. This collects realistic execution trajectories ($x$). These rollouts contain the full history of tool calls, observations, and environment changes.
4. Trajectory Supervision: Finally, the trajectories are annotated with safety labels and rationales. This data is used to train guard model backbones, such as Qwen3-Guard or Llama-Guard. These models learn to recognize the cumulative risk of a full execution trace.

Crucially, the framework is self-evolving. It uses errors on a held-out validation split to identify "hard cases." These are trajectories that the current guard model failed to catch. These failures are fed back into the loop. This allows the system to refine the taxonomy and synthesize new, more challenging tasks. The defense thus co-evolves with the threat landscape.

Significant gains in trajectory detection

The authors evaluate BraveGuard on two major benchmarks: AgentHazard-Strongest and ATBench-500. The most striking result is found on AgentHazard. The paper reports that while off-the-shelf guard models achieve an average detection accuracy of only 38.79%, BraveGuard-trained guards increase this to 82.38%. This represents a massive jump in reliability for spotting dangerous agent behavior.

The delta is even more pronounced when looking at recall (the ability to correctly identify all actual threats). The authors measure that averaged over various backend settings, off-the-shelf models struggle with a recall of roughly 20-28%. This means they miss the vast majority of unsafe trajectories. In contrast, BraveGuard-trained models achieve recalls exceeding 80-90%. This is critical for production systems. A false negative (a missed attack) is often far more costly than a false positive.

The effectiveness of the training is further broken down by risk category in . BraveGuard is highly effective against destructive actions and privilege escalation. However, the authors note it still faces challenges with more subtle categories. These include data exfiltration and compliance bypass. These risks rely on deep cross-step dependencies. Furthermore, shows that the complexity of the synthesized tasks is tightly controlled.

Most tasks center around 3 to 4 steps. This ensures the model learns from realistic, manageable horizons rather than extreme outliers.

Constraints on deployment

While the results are impressive, there are clear boundaries to what BraveGuard provides. First, the system's efficacy is tied to the quality of its discovery phase. If the threat discovery agent fails to find a specific vulnerability in research papers, that risk remains a blind spot. Similarly, if the task synthesizer cannot turn a threat into a functional task, the model will not learn it.

Second, there is a potential for format mismatch. The framework was developed using OpenClaw trajectories. While the authors demonstrate successful cross-format generalization on ATBench-500 (achieving 86.4% accuracy), they admit performance may vary elsewhere. This happens if an agent uses a radically different tool interface or execution environment. For a practitioner, this means you cannot simply drop a BraveGuard model into a custom environment and expect immediate parity. You would likely need to run your own rollout collection to align the training distribution with your specific toolset.

The verdict

BraveGuard is a necessary evolution for anyone moving from LLM chatbots to autonomous agents. The core insight is that safety is a property of the execution trace, not the prompt. This insight is empirically validated. By automating the pipeline from "reading a security paper" to "training a guard model," the authors have created a scalable way to fight evolving threats.

If you are building agentic workflows that touch sensitive files or terminals, do not rely on standard prompt-based guardrails. They are demonstrably inadequate for catching multi-step exploits. The BraveGuard approach is a viable blueprint for a production defense stack. However, you should prepare to invest in collecting your own execution traces. This ensures the guard is calibrated to your specific environment. Code is reportedly available at https://github.com/Yunhao-Feng/BraveGuard.