The interesting number in StepGuard isn’t the 77.3% cut in attack success rate. It’s the 2.8-point drop in utility that bought it.
Most agent guardrails I’ve run judge a trajectory after the fact — the tool already fired, the file already got deleted, the record already leaked. Post-hoc detection is fine for offline evals and audit trails, but it’s the wrong control loop for an agent with write access. StepGuard moves the check to where it belongs: step-level, before the tool call executes. It inspects the pending action against the interaction history and decides whether to let it through.
The part worth stealing is how they trained it. StepGen builds pairs with identical context but a safe versus unsafe action at the risky step, so the guard learns the decision boundary that actually matters instead of pattern-matching on scary-looking tool names. Then Balance-GRPO tunes the safe/unsafe learning ratio by observed accuracy — a direct attack on the over-defense problem that quietly kills these systems. A guard that blocks a third of legitimate actions never ships, no matter how safe it looks on a benchmark.
That’s why the utility figure is the real headline. A 77% reduction in attack success for 2.8 points of task utility is a tradeoff a platform team would actually sign off on; the same safety win at 15 points is a non-starter. And they hit it with an open-weight guard scoring comparable to GPT-5.4, which means it can sit inline without a frontier-model tax on every step.
The HF paper page has the AgentDojo and AgentDyn breakdowns. My open question: pre-execution guarding adds a serial hop to every tool call — what does that do to your P99 once the agent is chaining twenty of them?