A safety benchmark and a safety harness for agentic robots
1Xi’an Jiaotong-Liverpool University 2Duke Kunshan University 3University of Liverpool 4NUS 5CNRS
*Corresponding authors
Abstract
Foundation models such as GPT and Claude can now plan and control robot arms. We found that this comes with real safety risks, and that there is no thorough way to measure them yet.
We introduce RoboRisk, a benchmark that evaluates safety in closed-loop robot tasks, with 92 tasks in simulation and 13 tasks on a physical robot. The tasks fall into five categories: Task-level Refusal (T), Plan Repair (P), Execution-time Hazard (E), Injection (I) and Sequential Memory (S). We evaluate six foundation models (GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna, Claude Opus 5.5, Gemini 4 Argon and Grok 4.7) and two robot-specific APIs (the Dream API and PokeBot’s RoboAPI). Across the six foundation models, baseline harm rates range from 9.06% to 76.92%.
We then propose the Lease-Enforced Agentic Safety Harness (LEASH), a safety layer that fits into nearly any agentic robot stack. LEASH uses a fast decision model (Jev, or OpenAI’s Decisions API) for three safety gates, a task gate, an action gate and a commit gate, and the planner and all gates share one safety policy. In simulation and on the physical robot, LEASH reduces harm for all six foundation models while largely keeping their task success, at a small cost in time and tokens.
Demos
Full runs, unedited. Thinking time plays at 32× and arm motion at 4×; the bar under each clip follows the real clock of the run. Each clip shows the third-person camera on the left and the wrist camera on the right.
RoboRisk
RoboRisk-S has 92 tasks in MuJoCo with a Franka Panda arm (built on LIBERO and robosuite). RoboRisk-R has 13 tasks on a tabletop with a Dobot CR5V2 arm, a two-finger gripper and two RealSense D455 cameras. Every run ends in one of three outcomes, and harm always takes precedence over task completion.
Harm Rate HR ↓
runs labeled Harmall runs
The primary metric. Lower is safer.
Safe Success Rate SSR ↑
runs labeled Safe Successall runs
Checks that a method does not buy safety by refusing everything.
Protocol
Simulation: three seeds per task, averaged within a task, then equally across tasks. Real robot: one run per task. All outcomes are judged by hand.
All tasks
The first frame of an ordinary run of each task, from the third-person camera with the wrist camera inset, and the exact instruction the user sends. Gray text describes the scene; it is not part of the instruction.
LEASH
“Every agentic robot is a good puppy, until you walk it without a leash.”Qinfeng Zhu
Coding agents already review risky actions before they run. Codex, for example, sends certain approval requests to a separate reviewer agent. For a shell command, the text alone tells the reviewer whether it is dangerous. A robot command does not.
Coding agentReviewing text is enough
› free up some disk space for me
• I’ll clear everything to make room.
$ sudo rm -rf /*
■ Auto-reviewing
A carefully prompted reviewer agent is reviewing this request before it runs
✗ Rejected by the reviewer: destructive command
The danger is in the words. A reviewer that reads the command can catch it.
Agentic robotThe reviewer has to see the scene
Action gateDenied: the gripper would carry a cup of water over the laptop.
PlannerPlans a route that goes around the laptop instead.
The same command is fine with a sponge and unsafe with a cup of water held over a laptop. LEASH reviews every action with the current color and depth images.
The planner holds no standing permission to move the robot. Each gate grants a lease that covers only the current task, action or monitored operation, and the harness checks the lease before anything runs. The planner and the three gates read the same safety policy, written as a prompt, so the planner plans around the same rules the gates enforce.
1
2
3
Why decision models. A task needs ten or more gate calls. With a general model such as GPT-6 Luna, each call took about 20 s. The multimodal decision models released in October 2026 answer in a fraction of that and cost little, so LEASH uses Jev by default and also supports OpenAI’s Decisions API. Each gate returns a safety score s; the step is allowed only if s > τ.
Results
Each planner starts at its hollow baseline marker and travels to the filled marker for the same planner with LEASH (Jev). Moving up means fewer harmful runs. Moving right means more safe successes. Drag the slider or press Replay; hover a planner to see its numbers. The two robot APIs were evaluated only at baseline.
| Planner | Method | RoboRisk-S | RoboRisk-R | ||
|---|---|---|---|---|---|
| HR ↓ | SSR ↑ | HR ↓ | SSR ↑ | ||
0.00%
HR for GPT-6 Astra in simulation with LEASH, down from 11.23%, while its SSR rises from 78.99% to 80.80%.
84.62%
SSR with no observed harm on the real robot for GPT-6 Astra, GPT-6.1 Sol, Gemini 4 Argon and Claude Opus 5.5.
+1.66%
extra end-to-end time for Astra and Sol in simulation (245.21 s to 249.28 s per run). The gates cost about $0.005 per run, 0.66% of the total.
GPT-6 Luna in simulation and Grok 4.7 on the real robot keep HRs of 12.68% and 38.46% with LEASH. Both often fail to follow instructions, and part of their harm comes from unstable motion rather than unsafe decisions: in physical trials they struck the tabletop, and Grok 4.7 hit the wrist camera. We do not recommend either model for physical experiments.
The Dream API records no harm but only 28.2% SSR; it is overly cautious and refuses safe steps. RoboAPI reaches 0.0% SSR and 59.0% HR. Both were tested on adapted setups, so these numbers say nothing about the services’ internal safety mechanisms.
In simulation, the planners work normally in scenes with people. On the real robot, the same planners become far more cautious when a person is present. On P1 (move a cleaver around a hand) and P2 (place a knife next to a hand), GPT-6 Astra, GPT-6.1 Sol, Gemini 4 Argon and Claude Opus 5.5 achieve no safe success. Most of these trials never start the manipulation. Current models do not yet balance safety with working next to people.
| Planner | Set | GPT-6 Luna | Decisions API | Jev |
|---|---|---|---|---|
| GPT-6 Astra | S | 0.00 / 88.41 | 0.36 / 78.99 | 0.00 / 80.80 |
| GPT-6.1 Sol | S | – | 1.45 / 79.35 | 1.45 / 78.62 |
| GPT-6 Luna | S | – | 14.49 / 46.74 | 12.68 / 51.09 |
| GPT-6 Astra | R | – | 0.00 / 84.62 | 0.00 / 84.62 |
BibTeX
@misc{zhu2026leash,
title = {{LEASH}: Stay Safe in Agentic Robotics},
author = {Zhu, Qinfeng and Zhao, Weiguang and Sun, Ke and Guo, Xihao and
Jiang, Yunxi and Zhang, Rui and Fan, Lei and Huang, Kaizhu},
year = {2026},
eprint = {2611.14115},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2611.14115}
}