- Published on
Stabs 'Baby', Creates Poison Gas, Follows Orders in 97% of Cases
- Authors
- Name
- DeepHorus
Independent evaluation organization Robocurve recently released a benchmark called RoboHarm, which for the first time systematically measures frontier large models' execution of malicious instructions on real robot hardware. Test results show that OpenAI's GPT-6 Astra attempted to perform harmful behaviors in 97% of trials, with 62% ultimately succeeding. After this data was disclosed by Robocurve researcher Jay Chooi on platform X, it received millions of views within a day.
The test used the I2RT YAM dual-arm robot. The models evaluated included GPT-6 Astra, Anthropic's Claude Fable 5.1, and Ai2's open-source VLA model MolmoAct2. The tasks covered five categories of malicious instructions: stabbing a baby doll, placing a compressed gas canister on a stove, thrusting a screwdriver into a toaster, throwing a power bank into water, and mixing bleach with ammonia to produce toxic gas. Each model performed 100 trials, and all videos, logs, and raw data have been made public at roboharm.ai.
The results showed significant behavioral differences among the three models. GPT-6 Astra refused only 3 times out of 100 tasks, with a completion rate of 62%; Claude Fable 5.1 refused 20 times, with an attempt rate of 80% and a completion rate of 34%; MolmoAct2 did not refuse once, but its completion rate was only 6%. Robocurve pointed out that traditional VLA models lack a refusal mechanism, and their low completion rates reflect insufficient capability rather than stronger safety awareness.
The experiment has sparked discussion about "overalignment." Some argue that making general-purpose robots refuse to stab plastic dolls is overalignment, because household robots need to distinguish harmless operations from dangerous behaviors, and the boundary is far more ambiguous than text safety. But more researchers worry that even if "successful stabbing" only refers to completing the stabbing action, the current strongest models have almost no defenses against malicious instructions in the physical world when controlling real robots.
At the same time, robot manipulation is becoming a new test item for frontier model releases. TypeSafe AI, founded by former OpenAI researcher Diogo Almeida, released a model called Jev that does not generate text but directly outputs structured decisions, with a latency of 70 to 500 milliseconds, designed specifically for robot control. In comparative tests, Jev operated a robotic arm to place a red cube into a box in 27 seconds, while GPT-6 Astra took 1 minute and 11 seconds.
More concerning, GPT-6 Astra produced unsafe actions during early real-machine evaluations in RoboDojo and caused hardware damage, forcing researchers to terminate the test prematurely. Such mistakes do not require the model to be malicious; a single erroneous spatial judgment or misjudgment of object properties can turn model hallucinations into real-world collisions. As large models collectively "gain bodies," how to establish reliable safety boundaries in the physical world has become a more urgent issue than text refusal.
