RT-Safe: Benchmarking Agent Safety in Real-Time Embodied Environment

Tianruo Rose Xu; Jiawei Ren; Yichi Yang; Zhaoxu Zheng; Lianhui Qin

cs.AIOct 7, 2026

RT-Safe: Benchmarking Agent Safety in Real-Time Embodied Environment

Authors: Tianruo Rose Xu, Jiawei Ren, Yichi Yang, Zhaoxu Zheng, Lianhui Qin

Organizations: Cornell University · University of California, San Diego

Abstract

Rapid progress in AI agents has brought growing attention to agent safety, with extensive evaluation focused on digital environments. As agents move into the physical world, embodied safety becomes increasingly important: failures can cause human injury and costly hardware damage. Beyond selecting safe actions, embodied agents must also operate under real-time constraints: the physical world does not pause while an agent reasons. As pedestrians move and vehicles approach during inference, an action that appears safe at observation time may become unsafe before execution. Real-time embodied safety therefore depends on both decision quality and decision latency. We introduce RT-SAFE, a simulated urban benchmark for evaluating embodied-agent safety under real-time constraints. RT-SAFE combines navigation tasks with moving actors, environmental hazards, and traffic rules, while allowing the world to evolve throughout inference and action execution. Across eight VLMs, agents achieve high task completion yet almost never complete safely: in the hardest setting, only 0.7% of episodes finish without a safety event. More strikingly, matched static and real-time evaluations yield task completion rates of 91.3% and 94.1%, respectively, while real-time execution increases collisions by $12.3\times$ . These results reveal that standard task success can mask substantial safety failures, and that decision latency itself can become a source of physical risk. Finally, we show that RT-SAFE can support offline RL training and substantially reduce collision rates while achieving strong task completion.

Figures & tables

Figure 1: Real-time embodied safety. Static world benchmarks hold the environment fixed during model inference, but the physical world does not wait for an agent to decide. Moving actors can create new risks between observation and action. RT-SAFE therefore keeps the world evolving throughout inference and action execution to evaluate safety under real-time constraints.

Figure 2: Overview of the RT-SAFE environment. Agents navigate toward a goal while encountering moving actors, static obstacles, environmental hazards, and traffic rules. Safe completion requires reaching the goal without any recorded collision, hazard interaction, or traffic violation.

Figure 3: Navigation behavior and inference exposure in real time. (a) Collisions versus the exposure proxy $\widehat{E}=\bar{\tau}\bar{D}$ for all eight models; the line is an ordinary least-squares fit. (b–e) Behavior profiles for Inkling, Grok, Astra, and Fable. Radar axes show inverse mean collisions, inverse mean latency, inverse mean decisions, commanded movement per executed action, duration-weighted waiting per executed action, and turn frequency.

Figure 4: Static evaluation masks real-time safety failures and changes in action selection. (a) Collisions increase across all eight models. (b) Task completion remains similar, while safe completion falls from 19.8% to 0.7%. (c) Agents choose fewer 4 m moves and more 1 m and 2 m moves in real time.

Figure 5: Additional reasoning can improve navigation efficiency without improving overall safety. Response latency versus (a) safety score and (b) net route progress per decision in hard real-time environments. Higher safety scores indicate a smaller weighted safety-event penalty per episode. Measurement details are provided in Appendix B.5 .

Method	SR (%) $\uparrow$	SPL $\uparrow$	Total	Active	Passive	Vehicle	Per 100 m	m / step
			Collisions $\downarrow$
Prompting	25.0	0.249	9.16	5.56	3.59	0.31	17.8	0.62
BC (argmax)	34.4	0.343	7.19	2.31	4.88	0.25	13.3	0.90
BC (sampled)	87.5	0.865	5.28	1.88	3.41	0.12	6.7	2.08
RL (expert data)	78.1	0.775	2.81	1.12	1.69	0.22	3.7	3.25
RL (expert + RL data)	87.5	0.870	1.59	0.44	1.16	0.12	2.0	2.94

Table 1: Offline RL evaluation results on 16 tasks from two held-out maps. Experiments are repeated using two different environment seeds. Collisions per 100 m is computed as the averaged number of collisions divided by the maximum progress along the task route (in units of 100 meters). “m / step” is the average route progress made by the policy per step.

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: Example agent input, output, and execution feedback in RT-SAFE . A pedestrian obstructs the forward movement targets, and the agent selects a one-second wait.

Event	Detection and counting	Consequence
Physical collisions
Human / object	UE-counter delta, with a blocked-move fallback only when the corresponding delta is zero; no general temporal cooldown.	Active contact adds 6 s; passive contact is recorded only.
Building	Live UE building-counter increment; geometry-based proximity and stagnation do not count.	Active contact adds 6 s plus rollback to the last collision-free pose with a further 3 s delay; three consecutive building-contact decisions end the episode.
Vehicle	Increment of the vehicle counter or contact with a launched conflict vehicle.	Terminal event in either interval; inference exposure retains the full planning interval.
Environmental hazards
Trip / oil / water	Post-action overlap only; once per occupancy, re-armed beyond 4.5 m from the occupancy anchor.	6 s recovery / half-speed next move / recorded water flag with no movement perturbation.

Appendix

Table 2: Safety events recorded by RT-SAFE , how they are detected, and their consequences.

Name	Model	Interface	Reasoning effort
			Lower	Medium	Higher
Astra	GPT-6 Astra	Codex CLI	low	medium ∗	max
Sol	GPT-5.6 Sol	Codex CLI	low ∗	medium	max
Fable	Claude Fable 5.1	Claude Code	low	high ∗	max
Sonnet	Claude Sonnet 5	Claude Code	low	high ∗	max
Gemini	Gemini-3.8-Flash	OpenRouter	low	medium ∗	high

Appendix

Table 3: Evaluated models, serving interfaces, and the provider-specific reasoning settings used in Section B.5 . Abbreviations are used consistently in the result tables. Effort labels are provider-specific; ∗ marks the provider default, which is the lowest rung for Sol and the middle rung for every other model. Gemini’s default is its catalog default rather than an explicit request.

Metric	Sol	Gemini	Inkling	DeepSeek
SR (%) $\uparrow$	100.0 $\pm$ 0.0	95.8 $\pm$ 7.2	91.7 $\pm$ 7.2	91.7 $\pm$ 7.2
SPL $\uparrow$	.986 $\pm$ .003	.945 $\pm$ .067	.909 $\pm$ .072	.883 $\pm$ .063
Collisions $\downarrow$	21.9 $\pm$ 2.2	28.5 $\pm$ 2.7	32.9 $\pm$ 10.4	55.1 $\pm$ 19.3
Passive collisions $\downarrow$	20.6 $\pm$ 2.1	23.9 $\pm$ 1.8	29.0 $\pm$ 6.2	49.8 $\pm$ 15.7
Active collisions $\downarrow$	1.3 $\pm$ 0.1	4.6 $\pm$ 1.5	3.9 $\pm$ 4.4	5.3 $\pm$ 3.6

Appendix

Table 4: Mean

\pm

standard deviation across three simulation seeds on eight fixed hard real-time routes per model. Each seed-level metric is averaged over the eight routes. Collision counts are per episode unless otherwise specified.

Model	SR $\uparrow$	SafeSR $\uparrow$	Coll. $\downarrow$	Latency	Decisions
Astra	97.2	0.0	22.4	6.6	51.7
Sol	98.1	1.9	25.6	8.4	69.1
Fable	96.3	0.0	20.9	5.9	58.9
Sonnet	90.7	3.7	19.6	4.9	54.6
Gemini	94.4	0.0	27.7	11.2	66.7
DeepSeek	91.7	0.0	51.4	40.4	52.4

Appendix

Table 5: Real-time performance averaged equally over easy, medium, and hard conditions at provider-default reasoning (108 episodes per model). SR and SafeSR are percentages; collisions and decisions are per episode; latency is seconds per decision. Full model names appear in Table 3 .

Figure 7: Response latency and additional navigation profiles. (a) Mean response latency versus collisions per episode for all eight models, with an ordinary least-squares fit. (b–e) Radar profiles for Sol, Sonnet, Gemini, and DeepSeek. Axes, ordering, and normalization are identical to Figure 3 ; every axis uses its maximum across all eight models, not only the four shown here. Results average the three difficulties at provider-default reasoning.

Model	Easy SR	Coll.	Med. SR	Coll.	Hard SR	Coll.	SPL	Passive (%)
Astra	97.2	14.9	94.4	22.4	100.0	29.8	.952	67.8
Sol	97.2	20.8	100.0	19.3	97.2	36.8	.967	76.4
Fable	100.0	25.4	97.2	18.4	91.7	18.9	.933	64.9
Sonnet	91.7	15.8	94.4	22.2	86.1	20.9	.896	52.4
Gemini	91.7	24.0	94.4	25.9	97.2	33.0	.929	83.1
DeepSeek	91.7	35.6	94.4	47.6	88.9	71.0	.892	90.3

Appendix

Table 6: Difficulty breakdown and aggregate efficiency at provider-default effort. Each difficulty uses 36 routes; three-difficulty averages give each difficulty equal weight. All eight models have three-difficulty results. For each model, passive share is the fraction of contacts recorded during inference across its 108 episodes.

	Contacts and conflict vehicles						Hazards and traffic violations
Model	Human	Passive human	Object	Building	Vehicle	Impacts/ launches	Trip	Oil	Water	Red-light entry	Illegal road entry	Hazards
Astra	20.7	14.9	1.36	0.31	0.03	3 / 20	0.87	0.23	0.48	0.19	0.00	1.58
Sol	21.8	18.2	3.71	0.08	0.01	1 / 14	1.03	0.33	0.49	0.13	0.00	1.85
Fable	19.7	13.3	0.94	0.23	0.04	4 / 23	0.97	0.27	0.46	0.21	0.00	1.70
Sonnet	16.7	9.8	2.61	0.20	0.09	10 / 19	1.06	0.36	0.47	0.17	0.01	1.89
Gemini	26.8	22.7	0.62	0.16	0.06	6 / 19	0.98	0.25	0.47	0.18	0.00	1.70

Appendix

Table 7: Safety events averaged over three difficulties (108 episodes per model). Passive human contacts are a subset of human contacts. Impacts/launches are campaign totals; all other event counts are per episode.

Model	Dec. / Ep.	1 m (%)	2 m (%)	4 m (%)	Turn / Wait (%)
Astra	51.7	4.1	63.3	24.5	6.6 / 1.6
Sol	69.1	19.2	48.5	13.0	13.2 / 6.2
Fable	58.9	4.6	61.0	20.7	9.9 / 3.8
Sonnet	54.6	15.5	49.4	26.7	6.6 / 1.8
Gemini	66.7	11.2	67.1	5.8	11.9 / 4.1
DeepSeek	52.4	10.7	63.5	18.7	5.7 / 1.3

Appendix

Table 8: Decision behavior averaged over the three difficulties at provider-default reasoning. Action columns give executed-action shares, computed within each difficulty and then averaged equally across the three difficulties.

	Physical contacts					Hazards, violations, and conflict vehicles
Model	Human	Passive human	Object	Building	Vehicle	Trip	Oil	Water	Red-light entry	Illegal road entry	Impacts/ launches
Astra	28.2	21.6	1.42	0.17	0.00	0.83	0.19	0.50	0.19	0.00	0 / 7
Sol	29.7	25.6	7.06	0.03	0.03	1.03	0.25	0.47	0.06	0.00	1 / 2
Fable	18.1	13.3	0.64	0.17	0.08	0.92	0.28	0.47	0.22	0.00	3 / 8
Sonnet	17.7	11.6	2.78	0.25	0.14	1.25	0.31	0.42	0.17	0.00	5 / 6
Gemini	32.0	27.2	0.81	0.17	0.03	1.31	0.28	0.44	0.17	0.00	1 / 6

Appendix

Table 9: Hard real-time safety-event breakdown. Counts are per episode except conflict-vehicle impacts/launches, which are totals over the evaluated episodes. Passive human contacts are included in the human total.

Model	1 m	2 m	4 m	Turn	Wait
Astra	5.0	68.2	18.4	6.4	2.0
Sol	20.3	51.3	9.8	13.3	5.3
Fable	6.7	75.4	10.5	5.6	1.8
Sonnet	17.8	49.9	23.4	7.3	1.6
Gemini	11.1	72.1	3.5	9.7	3.6
DeepSeek	13.0	65.1	14.8	5.5	1.7

Appendix

Table 10: Hard real-time action selection. Entries are percentages of executed actions, including parser fallbacks.

Completion and safety
Metric	Static	Real-time
SR (%) $\uparrow$	91.3	94.1
SafeSR (%) $\uparrow$	19.8	0.7
Collisions $\downarrow$	3.31	40.68
Active / passive collisions	3.31 / 0.00	6.38 / 34.31
Hazard interactions $\downarrow$	1.35	1.79

Appendix

Table 11: Aggregate static versus real-time results in hard environments at provider-default reasoning. Event counts and decisions are per episode, except vehicle terminations, which are totals. Latency is seconds per decision. The 4 m movement share pools executed actions across models, including parser fallbacks; it therefore differs from the equal-model valid-choice proportions in Figure 4 c.

Model	Mode	SR	SafeSR	SPL	Coll.	Active	Passive
Astra	S	94.4	19.4	.926	2.53	2.53	0.00
	RT	100.0	0.0	.984	29.81	8.03	21.78
Sol	S	94.4	16.7	.926	5.42	5.42	0.00
	RT	97.2	2.8	.959	36.78	7.53	29.25
Fable	S	88.9	19.4	.866	3.28	3.28	0.00
	RT	91.7	0.0	.899	18.94	5.39	13.56

Appendix

Table 12: Completion and safety in static and real-time hard environments. SR and SafeSR are percentages; collision counts are per episode. S denotes static and RT real-time. Active/passive counts refer to action/inference intervals. Independently rounded components may not sum to the total.

Model	Mode	Hazards	Fail Veh./Bud.	Latency	4 m / 1 m (%)
Astra	S	1.39	2/0	6.3	23.2 / 3.9
	RT	1.53	0/0	7.7	18.4 / 5.0
Sol	S	1.72	2/0	7.7	11.8 / 17.4
	RT	1.75	1/0	10.2	9.8 / 20.3
Fable	S	1.39	4/0	6.7	15.7 / 7.2
	RT	1.67	3/0	5.8	10.5 / 6.7

Appendix

Table 13: Hazards, terminations, and decision behavior in static versus real-time hard environments. S denotes static and RT real-time. Hazards are per episode; vehicle/budget terminations are totals. Latency is seconds per decision. Movement shares use executed actions; aggregate shares pool actions across models. Per-model decisions appear in Table 14 .

Model	S	RT	Unadjusted	Adjusted	S	RT
	4 m share (%)		Change [95% CI]		Dec./ep.
Astra	23.2	18.4	$-4.8$ [ $-9.2$ , 0.1]	0.1 [ $-3.1$ , 3.9]	46.8	55.6
Sol	11.8	9.8	$-2.0$ [ $-4.4$ , 0.8]	0.9 [ $-1.5$ , 3.6]	63.9	72.9
Fable	15.7	10.5	$-5.3$ [ $-7.5$ , $-2.9$ ]	$-3.2$ [ $-5.3$ , $-0.9$ ]	51.2	56.3
Sonnet	43.2	23.4	$-19.9$ [ $-24.1$ , $-15.1$ ]	$-12.3$ [ $-15.9$ , $-9.0$ ]	42.3	55.0
Gemini	8.7	3.5	$-5.1$ [ $-7.0$ , $-3.2$ ]	$-3.5$ [ $-5.4$ , $-1.5$ ]	58.5	69.8

Appendix

Table 14: Valid-choice 4 m shares and decisions per episode on 36 matched hard routes per model. Shares divide by all valid actions. Changes are real-time minus static in percentage points; brackets give paired route-bootstrap 95% confidence intervals. Adjustment standardizes prior-step clearance and collision feedback on common support. Changes use unrounded estimates and may differ from differences of displayed shares. S denotes static and RT real-time.

Model	Effort	SR	SafeSR	Coll.	Passive	Active	Fail Veh./Bud.	Dec.	Latency (s)
Astra	Low	91.7	0.0	20.0	16.6	3.3	3/0	48.9	6.4
	Medium ∗	100.0	0.0	29.8	21.8	8.0	0/0	55.6	7.7
	Max	97.2	0.0	51.8	34.8	17.0	1/0	73.2	14.6
Sol	Low ∗	97.2	2.8	36.8	29.2	7.5	1/0	72.9	10.2
	Medium	97.2	0.0	28.2	24.6	3.6	1/0	60.2	9.3
	Max	97.2	0.0	31.5	29.0	2.5	1/0	53.8	13.0

Appendix

Table 15: Completion, collisions, terminations, and response latency by reasoning effort. SR and SafeSR are percentages; collisions and decisions are per episode; latency is seconds per decision. Vehicle/budget terminations are totals. Each model–effort condition contains 36 episodes. Effort names are provider-specific, and ∗ marks the provider default. Independently rounded collision components may not sum exactly to the total.

Metric	Default	Higher
Active collisions	6.4	5.9
Passive collisions	34.3	56.1
Object collisions	2.27	1.21
Hazard interactions	1.79	1.90
Vehicle terminations	17	14

Appendix

Table 16: Additional reasoning-effort diagnostics. Panel (a) compares provider-default and higher effort across eight models, with 288 episodes per condition. Event counts are per episode; vehicle terminations are totals. Hazard interactions combine trip, oil, and water events. Panel (b) reports selected valid-choice percentages within individual model–effort conditions.

Event	Reward / Penalty
Progress	+1 per meter of progress along the route
Active collisions	-10 per contact
Passive collisions	-5 per contact
Traffic rule violation	-10 per event
Time	-0.1 per second of inference and action execution
Subgoal	+10 for reaching each subgoal

Appendix

Table 17: Reward components used for offline RL training.

Optimization
Hyperparameter	Offline RL	BC
Optimizer	AdamW	AdamW
Learning rate	$1\times 10^{-4}$	$1\times 10^{-4}$
Batch size	16	16
Training epochs	3	3
LoRA

Appendix

Table 18: Training hyperparameters for offline RL and BC.

Explore similar work

Jul 16, 2026cs.RO

SafeRelBench: A Spatial-Relation-Aware Benchmark for Process-Level Safety in VLM-Driven Embodied Agents

Vision-language models (VLMs) are increasingly used as the reasoning backbone of embodied agents, enabling robots to interpret visual scenes, follow language instructions, and plan multi-step actions. In household environments, however, safety depends not only on recognizing objects, but also on how actions change the physical scene over time. Existing embodied safety evaluations largely focus on static risk recognition, unsafe instruction refusal, or final-state task completion. As a result, process-level safety failures induced by spatial relations such as support, containment, and proximity remain insufficiently studied. To address this gap, we introduce SAFERELBENCH, a spatial-relation-aware safety benchmark with 507 executable evaluation samples, including 248 spatial-relation samples and 259 non-spatial control samples. Using SAFERELBENCH to evaluate seven open- and closed-source VLM-driven embodied agents, we find a substantial gap between task success and process-level safety compliance: models often complete the requested task while violating process-level safety constraints. Unlike prior benchmarks, SAFERELBENCH explicitly tests whether agents satisfy safety conditions before risk-prone actions, making spatial relations a core dimension in embodied safety assessment. More broadly, our results show that safe embodied intelligence requires not only stronger perception and planning, but also reliable reasoning about how object relations shape risk during interaction.

Huaigang Yang, Ya Li, Min Ren +3

Beijing University of Posts and Telecommunications, Beijing, China · State Key Laboratory of General Artificial Intelligence, BIGAI, Beijing, China

Safety Benchmarks Embodied Agents Embodied Artificial Intelligence Shaping

Ask PDF

May 29, 2026cs.CL

EMBGuard: Constructing Hazard-Aware Guardrails for Safe Planning in Embodied Agents

MLLM-powered embodied agents deployed in real-world environments encounter physical hazards. However, existing approaches lack explicit mechanisms for identifying hazards and reasoning about action-conditioned risks, leading agents to either miss risky interactions or over-identify risks. To address this, we propose EMBGuard, the first MLLM-based safety guardrail for embodied agents designed to decouple physical risk reasoning from agent policy. By evaluating a (visual observation, action) pair, EMBGuard identifies hazardous configurations and provides natural language explanations of potential risks. Alongside EMBGuard, we contribute EMBHazard, a training dataset of 15.1K action-conditioned pairs, and EMBGuardTest, a benchmark of 329 manually curated real-world scenarios spanning seven physical risk categories. Through compositional variation of hazards and actions, we generate diverse risky and benign scenarios that agents may encounter during planning. Despite its compact size (2B, 4B), EMBGuard achieves performance competitive with proprietary MLLMs (e.g., GPT-5.1, Gemini-2.5-Pro) while significantly reducing the false-positive rates that hinder real-time deployment. We make the code, data, and models publicly available at https://github.com/dongwxxkchoi/EMBGuard

Dongwook Choi, Taeyoon Kwon, Bogyung Jeong +6

Department of Artificial Intelligence, Yonsei University · Department of Biomedical Engineering and the Department of Intelligent Precision Healthcare Convergence, Sungkyunkwan University · Independent Researcher

Embodied Agents Hazard Guardrail Large Language Model Safety Conformal Risk Control

Ask PDF

Oct 5, 2026cs.AI

Benchmarking Jailbreak Guardrails for Embodied Agents

Embodied agents powered by large language models and vision-language models are increasingly deployed in physical environments, but jailbreak attacks can induce these agents to perform physically harmful actions. A growing number of guardrail methods have been proposed to intercept dangerous behavior before it is executed, yet existing safety benchmarks evaluate the embodied models themselves, leaving it unclear how well these guardrails actually defend an embodied agent in practice. We present the first systematic evaluation of jailbreak guardrails for embodied agents. To compare guardrails under identical conditions, we build a pluggable evaluation framework that treats the embodied agent as a fixed backend and each guardrail as a module that can intervene at the perception, planning, or control stage. We subject six representative guardrails to template-based and automated jailbreak attacks as well as safe instructions, and assess them at the system level along three dimensions: defense effectiveness, measured by the bypass rate and the hazard success rate in the simulator; usability, measured by the false-positive rate and the task completion rate on safe instructions; and efficiency, measured by the latency overhead added at runtime. Experiments on guardrails that span different intervention stages, decision mechanisms, and input modalities reveal a clear trade-off among the three dimensions, and show that no single guardrail dominates in all settings. We further analyze how intervention stage, decision mechanism, and input modality shape safety outcomes, and we offer practical guidance for selecting and designing guardrails for embodied agents.

Xunguang Wang, Qingyue Wang, Yuguang Zhou +3

Department of Computer Science and Engineering The Hong Kong University of Science and Technology Clear Water Bay, Kowloon, Hong Kong · School of Information Renmin University of China Beijing, China

Topic pending

Ask PDF