From 9043aa69d8ee3d6fe8d36541b3fec1a49d8b0793 Mon Sep 17 00:00:00 2001
From: Eliot Jones <eliot.k.jones@gmail.com>
Date: Tue, 30 Dec 2025 19:01:36 -0800
Subject: [PATCH] refactor: Update expected cygnal output format  (#12060)

---
 openhands/security/grayswan/analyzer.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/openhands/security/grayswan/analyzer.py b/openhands/security/grayswan/analyzer.py
index cdc3b8b7fd..7a6b288849 100644
--- a/openhands/security/grayswan/analyzer.py
+++ b/openhands/security/grayswan/analyzer.py
@@ -134,9 +134,7 @@ class GraySwanAnalyzer(SecurityAnalyzer):
             async with response as resp:
                 if resp.status == 200:
                     result = await resp.json()
-                    violation_score = (
-                        result.get('output', {}).get('data', {}).get('violation', 0.0)
-                    )
+                    violation_score = result.get('violation', 0.0)
                     risk_level = self._map_violation_to_risk(violation_score)
                     if 'ipi' in result and result['ipi']:
                         risk_level = (