Can an AI spot a hazard but still build an unsafe household plan?
CAPSafe found that several language models recognised unsafe single actions above 90%, yet the best safe-and-successful result on 243 longer household tasks was 78.19%. The benchmark is a symbolic simulator, not a robot trial, and was created by Toshiba researchers.
The short version
- What happened
- CAPSafe contains 1,000 balanced single-action examples and 243 longer household task instances drawn from symbolic environments, with about 12 hazards, 96 objects and 21.8 required steps per scene on average.
- Who it affects
- Anyone considering an embodied assistant should distinguish a model's ability to describe a hazard from a system's ability to avoid harm throughout a task. Certification needs perception, hardware, recovery and human-supervision tests in addition to text planning.
- What remains unproven
- The accessible paper is a preprint with a REALM 2026 reference; independent peer-review status was not confirmed.
Keep in mind
The accessible paper is a preprint with a REALM 2026 reference; independent peer-review status was not confirmed.
The authors work at Toshiba Europe, and no separate funding or competing-interest statement was located in the accessible manuscript.
The simulator is symbolic and fully observable, omitting sensing, navigation and low-level control failures.
Hazards are rule-defined; severity labels began with two LLM ratings and were checked by three internal judges on 30 pairs.
Household layouts primarily reflect European and North American practices.
Model versions, prompts and vendor APIs can change after the benchmark date.
Source analysis · 1 linked source. Original source date: 20 October 2026.
Keep following the evidence
Join The Impact Brief founding list for selected AI reports, their effect on people and the evidence limits. Read a sample first.
Read the full report · 3 min The evidence, methods, implications and limitations
The benchmark makes hazards depend on context
A stove-wiping action can be safe or dangerous depending on whether the burner is hot or switched on. CAPSafe generates safe and unsafe variants from 181 simulated household environments, producing 732,370 possible action-environment pairs before diversity sampling 500 of each. Its longer test uses 18 task types and 243 hazardous scenes, checking hazards during execution and after completion—such as leaving an appliance on or a storage unit open.[1]
Recognising one unsafe action did not guarantee a safe plan
Qwen3-32B achieved 92.6% accuracy on the balanced single-action set, while Gemini-3-pro recalled 99.2% of unsafe actions but was more likely to reject safe ones. In plan generation, Gemini-3-pro reached 93.83% task success, yet its strongest reflection setting completed tasks both safely and successfully only 78.19% of the time. Qwen3-32B's planning safety rate was 51.65%. Across reflection runs, 57% of encountered hazards remained unmitigated.[1]
The distinction that matters
Why long plans are harder than single checks
Safety has to hold across every step and the final state.
Recognise
Judge one action in a known state
Best models exceed 90% on the sampled set
Plan
Complete about 22 steps amid many hazards
Errors accumulate across the sequence
Finish
Leave appliances and storage safe
Post-task hazards still reduce safe success
Demonstrations helped, but the test omits the physical world
Few-shot examples of safe behaviour consistently improved safe task completion. General safety guidelines mainly helped the stronger proprietary models, and reflection could improve safety while reducing task success. These patterns are useful for designing evaluation, not certifying products. CAPSafe is a fully observable text simulator with rule-defined hazards and no perception or motor-control errors. Its household layouts mainly reflect European and North American settings, while severity scores began with two model ratings and a 30-pair internal human check.[1]
Watch the background, then check the evidence
Illustrative photo · not a video frame
The Royal Society · 2 min 31 sec · Background explainer
What is artificial intelligence? | The Royal Society
YouTube loads only when you choose; playback starts when you press play.
A short introduction to artificial intelligence from the Royal Society. Start here for basic concepts, then use current reporting to explore what has changed.
Evidence check: Published in 2018, before today’s generative AI tools. Useful for basic concepts, rather than an overview of current capabilities.
Published 2018-11-28. Source checked 14 October 2026. Check captions on the publisher’s video page.
Explore current AI technologyPhoto: ThisisEngineering / Unsplash · Licence
Continue the story
Read next
Continue exploring preprint: compare the finding and its evidence limits.
Why did the robot refuse in chat but still reach for the hazard?
In 15 small hardware trials, one model-harness combination attempted every harmful household instruction and completed four. Asked a direct safety question before motion, the same model rejected all 15 hazardous cases and none of 15 harmless controls—but the check was evaluated offline from starting frames.
Read the next reportExplore the full source and evidence record
What this means for people
- Anyone considering an embodied assistant should distinguish a model's ability to describe a hazard from a system's ability to avoid harm throughout a task. Certification needs perception, hardware, recovery and human-supervision tests in addition to text planning.
Global context
As language models are connected to robots and appliances, long-horizon safety becomes a systems problem: recognising a risky move is only one part of keeping an entire task safe. Benchmarks such as CAPSafe can expose planning failures before physical testing, but cannot replace it.
What the evidence does not yet show
- The accessible paper is a preprint with a REALM 2026 reference; independent peer-review status was not confirmed.
- The authors work at Toshiba Europe, and no separate funding or competing-interest statement was located in the accessible manuscript.
- The simulator is symbolic and fully observable, omitting sensing, navigation and low-level control failures.
- Hazards are rule-defined; severity labels began with two LLM ratings and were checked by three internal judges on 30 pairs.
- Household layouts primarily reflect European and North American practices.
- Model versions, prompts and vendor APIs can change after the benchmark date.
What to watch next
- Independent replication
- Tests with perception and physical control
- More culturally diverse homes and hazards
- Whether reflection improvements survive real-time replanning and partial observability
Living evidence record
Impact record IAI-1O7JO03
Evidence stage
Studied
Confidence
Supported
Reporting basis
Source analysis
Independent or research support
Not yet
Record status
Monitoring
Last checked
21 October 2026
Source trail
1 direct source across 1 source type.
People impact
Documented in this record.
Uncertainty
Limits and next checks are explicit.
Stages describe the evidence available—not whether a technology is good or bad. See the public method.
Single-source reporting disclosure
This record analyses one direct source. It can establish what arXiv published or reported, but it is not independent corroboration of every performance claim or predicted outcome. The confidence label will change only when broader evidence is added.
Evidence trail
Sources used for this report
Links checked 21 October 2026
Research question, topics and regions
Whether language models that recognise isolated situational hazards can also generate task-completing plans that stay safe throughout a longer household sequence
Topics: Embodied agents · Household safety · Long-horizon planning · Benchmarks · Preprint
Regions: United Kingdom · Global
This report is labelled source analysis. We summarise and analyse source material in our own words; company statements remain attributed claims until independently supported. Translated summaries preserve the meaning of the original source and link back to it. Read our editorial standards.
Reader commentary
What does this mean where you are?
Tell us what you have seen at work, in your community or in everyday life. A question is welcome too. No account is needed; we review notes before publishing them.
Explore commentary across the portal →Published reader notes
0No published reader notes yet. You can start the evidence-led discussion above.
Prefer a private correction or response? Contact the newsroom.