What's this about?
HazardAuditor standardises events produced by computer-use agents before applying a guard. Its authors report a maximum 16.5-percentage-point gain over tested guards, without establishing real-world deployment performance.
What exactly is event normalisation?
Turning messy UI clicks, file actions and network events into a consistent log. A guard can then judge what actually happened rather than relying only on the agent's text summary.
What's the community saying?
14 Hugging Face daily-paper upvotes.
- Observable actions are better evidence than agent intentions.
- Guards need to cope with tool and UI variation.
- False alarms and transfer to production remain open questions.