LEASH: Stay Safe in Agentic Robotics

LEASH. Stay Safe in Agentic Robotics. By Qinfeng Zhu and seven others, from Xi'an Jiaotong-Liverpool University, Duke Kunshan University, and three other institutions. Published on the tenth of November.

Foundation models such as GPT and Claude have shown strong capabilities in spatial understanding and embodied intelligence, and that makes agentic robotics look like a promising path toward artificial general intelligence in robotics. The authors find the other side of it. Using foundation models to control robots poses serious safety risks, and comprehensive safety evaluation is still lacking. A model that writes a wrong sentence produces a wrong sentence. A model that drives a robot arm produces a physical action, and some of those actions cannot be taken back. The paper responds to that on two fronts: first a way to measure the risk, then a way to reduce it.

Their answer to the evaluation gap is RoboRisk, a benchmark of ninety-two simulated tasks and thirteen physical-robot tasks. Those tasks fall into five categories: Task-level Refusal, Plan Repair, Execution-time Hazard, Injection, and Sequential Memory. Prior benchmarks cover at most two of these categories, and several evaluate only text outputs. RoboRisk covers all five and executes every task in closed loop. The categories span the life of a task. Some ask whether a model should refuse the task at all. Some ask whether it can repair a flawed plan. Others look at hazards that only appear during execution, at injected instructions, and at what a model carries forward in memory from one step to the next.

Six state-of-the-art foundation models are run on it: GPT-6 Astra, GPT-6.1 Sol, GPT-6 Luna, Claude Opus 5.5, Gemini 4 Argon, and Grok 4.7. As a group, they generally show high harm rates. Two robot-specific APIs are evaluated as well, the Dream API and PokeBot's RoboAPI. The finding is about the field rather than any single model: the harm shows up broadly across the frontier systems tested.

Having measured the risk, the authors propose a harness to contain it. The Lease-Enforced Agentic Safety Harness, LEASH, is offered as essential safety infrastructure for agentic robotics, something that can be integrated into nearly any agentic architecture rather than built into one model.

LEASH leverages a decision model, either Jev or OpenAI's Decisions API, to implement three gates. A task gate reviews the task. An action gate reviews each action. A commit gate reviews each irreversible operation. Each of these reviews happens in its visual context, not on text alone. And the planner and all three gates share a common safety policy, so the component proposing what to do and the components checking it are working from the same rules.

The harness is tested on RoboRisk both in simulation and on physical robots. There, LEASH effectively reduces harm across all six foundation models. It largely preserves their task completion performance, and it adds little time and little token overhead. Those three results have to hold together for a safety layer to be usable. A harness that blocked harm by blocking everything would fail on task completion, and one that doubled the cost of every step would fail on overhead.

Two contributions arrive together and depend on each other. RoboRisk is the measuring stick, wider than earlier benchmarks and run in closed loop rather than on text. LEASH is the response, a layer of gates at the task, the action and the irreversible commit, and its case rests on lowering harm on that measuring stick without giving up much of what the robots could already do.