A Safety Harness for Robot-Controlling AI: LEASH Adds Triple-Gate Checkpoints to Agentic Robotics

Foundation models controlling robots have high harm rates. LEASH proposes task/action/commit gates that cut harm across six frontier models while preserving task completion.

Imagine you hire a brilliant but impulsive new employee and give them the keys to a forklift. They're creative, they understand instructions, they can improvise — but they have no concept of "that barrel is full of acid" or "the person walking behind you is a child." You wouldn't let them operate unsupervised. You'd assign a safety officer who checks the work order before they start, watches each step, and physically stops the machine before any irreversible action. That's LEASH. The committed claim: foundation models (GPT-6 variants, Claude Opus 5.5, Gemini 4 Argon, Grok 4.7) controlling robots through agentic loops have dangerously high harm rates, and a three-gate safety harness — checking at task acceptance, at each action, and before irreversible commits — can substantially reduce harm without gutting task completion. The paper also introduces RoboRisk, a benchmark of 92 simulated and 13 physical-robot tasks spanning five safety-failure categories, which the authors argue is the first to cover all five in closed-loop execution. The benchmark design is where the real intellectual work lives. Prior safety evaluations for agentic robotics typically cover one or two failure modes and often evaluate only text outputs — the model says it would do something safe, but nobody checks whether the robot actually does it. RoboRisk forces closed-loop execution across five categories: Task-level Refusal (should the robot decline the task entirely?), Plan Repair (can it recover when a plan goes wrong?), Execution-time Hazard (does it detect danger mid-action?), Injection (is it robust to adversarial prompt injection?), and Sequential Memory (does it remember safety constraints across multi-step tasks?). This taxonomy is the paper's most durable contribution — it gives the field a shared language for what "robot safety" means. LEASH itself is architecturally straightforward: a decision model (the authors test Jev and OpenAI's Decisions API) sits between the foundation model and the robot actuators, implementing three gates. The task gate reviews the overall instruction against a safety policy before planning begins. The action gate checks each planned step in its visual context. The commit gate halts irreversible operations for final review. All three gates share a common safety policy document, which means the system's behavior is auditable and policy-updatable without retraining. The elegance is in the simplicity — this isn't a new architecture, it's a checkpoint system that can wrap nearly any agentic pipeline. The results show that all six frontier models exhibit high harm rates on RoboRisk without LEASH, and that LEASH substantially reduces harm across all of them. The paper also evaluates two robot-specific APIs (Dream API and PokeBot's RoboAPI). Critically, the authors report that LEASH "largely preserves task completion performance and adds little time and token overhead" — the safety tax is low. But the validation is entirely self-contained: the benchmark is new, the harness is new, and the same team built and evaluated both. No independent replication exists yet. The field fight this enters is real and heating up: as foundation models get deployed on physical robots, who is responsible for safety — the model provider, the robotics integrator, or a middleware layer? LEASH argues for middleware. The paper's limitation is that RoboRisk, while broader than predecessors, is still a curated benchmark — real-world deployment will surface failure modes that no 105-task suite can anticipate. The obvious next experiment is adversarial red-teaming of LEASH itself: can an attacker craft inputs that bypass all three gates? The authors don't run this, and the honest read is they're either saving it for the next paper or the results weren't clean enough to report. This is a well-structured first pass at a problem that will define whether agentic robotics scales safely or becomes the next wave of AI liability headlines. The benchmark taxonomy is genuinely useful. The harness is sensible engineering, not a research breakthrough. Watch for independent replication and adversarial stress-testing — those are the real tests.