Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-26 · high
StepGuard checks each tool call before it runs instead of grading the whole task afterward, and only costs 2.8 points of utility.
Why now: The paper posted August 26 with benchmark results against AgentDojo and AgentDyn.
A new guard model called StepGuard audits individual tool calls before an AI agent executes them, instead of scoring the completed run afterward, which is where most current guardrails sit. On the AgentDojo and AgentDyn benchmarks it cuts mean attack success by 77.3% while mean utility drops just 2.8 points, according to the paper.
That timing distinction matters more than it sounds. A trajectory-level guard reads the whole transcript after an agent has already called a tool, deleted a file, or sent a request. By the time it flags something wrong, the damage is done. StepGuard sits before execution, so it can block the risky step itself rather than write an incident report about it.
The training method is specific: paired safe and unsafe trajectories that share identical context and diverge only at one risky step. That forces the model to learn what makes a single action dangerous, not just what a bad outcome looks like in hindsight. The paper also describes a rebalancing scheme meant to fight two failure modes at once, guards that miss real attacks and guards that block legitimate actions too often.
The headline number worth sitting with is the utility cost. A 77% drop in attack success for 2.8 points of utility is a good trade if it holds outside the benchmark. Most safety filters buy security by making the agent noticeably worse at its job, and builders route around them for that reason. StepGuard reports the highest average accuracy among open-weight guards in the paper's comparison, putting it near GPT-5.4 on the same tests.
The paper doesn't say how the guard performs against attacks designed specifically to evade step-level screening rather than trajectory-level review, which is the next place I'd expect an adversary to push.
Each link below shares sources, entities, or timing with this story.
GPT competes with Claude / Shared entity: GPT / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (GPT competes with Claude); both cover GPT; reported by the same outlet (arxiv.org).
StepGuard benchmarked against AgentDojo / Shared entity: GPT / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (StepGuard benchmarked against AgentDojo); both cover GPT; reported by the same outlet (arxiv.org).
GPT competes with Claude / Shared entity: GPT / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (GPT competes with Claude); both cover GPT; reported by the same outlet (arxiv.org).
Claude Code benchmarked against GPT / Shared entity: GPT / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code benchmarked against GPT); both cover GPT; reported by the same outlet (arxiv.org).
Claude Code benchmarked against GPT / Shared entity: GPT / Same source domain / Earlier coverage
Linked by a graph relationship (Claude Code benchmarked against GPT); both cover GPT; reported by the same outlet (arxiv.org).
Linked by a graph relationship (Claude Code benchmarked against GPT); both cover GPT; reported by the same outlet (arxiv.org).
Claude Code benchmarked against GPT / Shared entity: GPT / Earlier coverage / Tension
Linked by a graph relationship (Claude Code benchmarked against GPT); both cover GPT; earlier GPT coverage from 2026-08-20.
GPT competes with Claude / Shared entity: GPT / Same source domain / Earlier coverage
Linked by a graph relationship (GPT competes with Claude); both cover GPT; reported by the same outlet (arxiv.org).