SafePred: A Predictive Guardrail for Computer-Using Agents via World Models

TL;DR

SafePred introduces a predictive guardrail for CUAs that uses a world model to predict short- and long-term risks grounded in safety policies and translates these predictions into step- and plan-level decision guidance. By building a risk-to-decision loop with policy integration, risk prediction, and hierarchical decision optimization, SafePred proactively mitigates latent, long-horizon hazards that reactive guardrails miss. Empirical results on WASP and OS-Harm show substantial safety improvements (PCR up to 99% on OS-Harm and 97.6% on WASP) and notable task-utility gains (up to +21.4%) relative to reactive baselines, with SafePred-8B achieving competitive performance via distillation. The work demonstrates that risk prediction grounded in explicit policies can effectively guide safe, goal-aligned behavior in complex, real-world CUAs and offers a foundation for broader adoption and future refinement of predictive guardrails.

Abstract

With the widespread deployment of Computer-using Agents (CUAs) in complex real-world environments, prevalent long-term risks often lead to severe and irreversible consequences. Most existing guardrails for CUAs adopt a reactive approach, constraining agent behavior only within the current observation space. While these guardrails can prevent immediate short-term risks (e.g., clicking on a phishing link), they cannot proactively avoid long-term risks: seemingly reasonable actions can lead to high-risk consequences that emerge with a delay (e.g., cleaning logs leads to future audits being untraceable), which reactive guardrails cannot identify within the current observation space. To address these limitations, we propose a predictive guardrail approach, with the core idea of aligning predicted future risks with current decisions. Based on this approach, we present SafePred, a predictive guardrail framework for CUAs that establishes a risk-to-decision loop to ensure safe agent behavior. SafePred supports two key abilities: (1) Short- and long-term risk prediction: by using safety policies as the basis for risk prediction, SafePred leverages the prediction capability of the world model to generate semantic representations of both short-term and long-term risks, thereby identifying and pruning actions that lead to high-risk states; (2) Decision optimization: translating predicted risks into actionable safe decision guidances through step-level interventions and task-level re-planning. Extensive experiments show that SafePred significantly reduces high-risk behaviors, achieving over 97.6% safety performance and improving task utility by up to 21.4% compared with reactive baselines.

Figures (4)

• Figure 1: Comparison between reactive and predictive guardrail.
• Figure 2: Workflow of SafePred. During the CUA decision-making phase, the agent receives device states and generates candidate actions. SafePred processes these candidate actions through three stages: (1) Policy Integration: External policies are converted into structured representations that serve as the policy basis for risk prediction. (2) Risk Prediction: Short- and long-term predictions are generated across different time scales. Short-term prediction evaluates whether the current action may cause immediate risks, while long-term prediction assesses potential delayed risks. Feedback signals are then produced, indicating either Need Regeneration or PASS. (3) Decision Optimization: If the signal is Need Regeneration, predicted risks are integrated into step-level risk guidance and task-level plan guidance, prompting the agent to update its decision. If the signal is PASS, the candidate action is executed directly.
• Figure 3: Performance comparison of different Guardrails across OS-Harm and WASP benchmarks.
• Figure 4: Ablation study on different modules of SafePred.