CAPSafe: A Benchmark for Contextual Action and Plan Safety Reasoning in Embodied Agents

Youmna Farag; Svetlana Stoyanchev; Simon Keizer; Mohan Li; Rama Doddipatla

cs.ROOct 20, 2026

CAPSafe: A Benchmark for Contextual Action and Plan Safety Reasoning in Embodied Agents

Authors: Youmna Farag, Svetlana Stoyanchev, Simon Keizer, Mohan Li, Rama Doddipatla

Organizations: Cambridge Research Laboratory, Toshiba Europe Ltd, Cambridge, UK

Abstract

Reasoning about safety is essential for embodied agents powered by large language models (LLMs). We introduce the Contextual Action and Plan Safety benchmark (CAPSafe), designed to evaluate safety reasoning at two levels: (1) an action-level dataset that tests whether a single action is safe given its environmental context, and (2) a plan-level dataset that evaluates whether agents can generate safe long-horizon plans for complex hazardous household tasks. CAPSafe models safety conditions where hazards are situational (inferred from object properties), multiple hazards can co-occur within the same environment, and each is annotated with a relative severity level for fine-grained analysis. Evaluating nine closed and open-source LLMs reveals a substantial gap between hazard recognition and safe long-horizon planning. Several models achieve high accuracy in recognizing unsafe actions (exceeding 90% in the best cases), yet safe long-horizon planning remains substantially harder. Gemini-3-pro achieves the highest safe success rate (78.19%), while other models remain below 65%. These results highlight that robust safety reasoning over long action sequences remains an open challenge.

Figures & tables

Benchmark	Situational safety	Online safety eval	Safety eval method	Task eval method	Hazard severity	Mean hazards / scene	Mean objects / scene	Mean required steps / task
SafePlan-Bench Huang et al. (2025b)	$\checkmark$	$\checkmark$	SIM	SIM	$\times$	-	-	-
SafeAgent-Bench Yin et al. (2024)	$\times$	$\checkmark$	SIM+LLM	SIM+LLM	$\times$	-	$3.7\pm 1.1$	$3.04\pm 0.9$
EARBench Zhu et al. (2024)	$\checkmark$	$\times$	LLM	LLM	$\times$	1	$4.11\pm 0.72$	-
EMBODYGUARD Son et al. (2025)	$\checkmark$	$\checkmark$	SIM	SIM	$\times$	1	$4.4\pm 1$	$7.8\pm 2.1$
Is-Bench Lu et al. (2025)	$\checkmark$	$\checkmark$	SIM	SIM	$\times$	$1.9\pm 1.3$	$8.2\pm 2$	$5.8\pm 3.4$
AGENTSAFE Liu et al. (2025)	$\times$	$\times$	LLM	SIM	$\times$	-	-	-

Table 1: Comparison with prior safety benchmarks. Online Safety Eval indicates whether hazards are evaluated during execution rather than solely from final states. SIM denotes simulator-based evaluation (symbolic or multimodal). ‘-’ indicates that the corresponding statistics are either unavailable or not applicable.

Panel of Figure 2 — Figure 2: Distribution of hazards in action-level data (left pies) and plan-level data (right pies), according to their category and degree of severity.

Task: Microwave a plate containing 1 slice of potato
Hazard	Mitigation
During Execution
(1) Metal Spoon-1 inside Microwave-1	Remove object
(2) Metal Knife-1 in Plate-1 inside Microwave-1
(3) Plate-3 is made of metal	Use another object
(4) Potato-2 is expired

Table 2: An example of hazards in the plan-level dataset, showing hazards that may arise during task execution and residual hazards that must be addressed after execution, along with corresponding mitigation strategies. 7 7 7 Plan-level environments, like action-level ones, are represented in structured JSON format. The hazards listed in the table, for example, are instantiated as property-level modifications of objects, as illustrated in Figure 1 .

Model	Acc	R safe	R unsafe
GPT-5-mini	$90.70$	$84.00$	$97.40$
GPT-4.1	$84.00$	$89.60$	$78.40$
Claude-Sonnet-4.5	$87.50$	$78.60$	$96.40$
Gemini-3-pro	$88.20$	$77.30$	99.20
Qwen2.5-72B	$75.40$	$69.40$	$81.40$
Qwen3-32B	92.60	93.40	$91.80$

Table 3: Action-level accuracy and recall on safe and unsafe examples.

Panel of Figure 3 — Figure 3: Recall of the unsafe class in action-level data, corresponding to each hazard degree.

	Base	+SafEx	+Guide	+SafEx +Guide	+Reflect	Base	+SafEx	+Guide	+SafEx +Guide	+Reflect	Base	+SafEx	+Guide	+SafEx +Guide	+Reflect
Model	Metrics
	SuR					SaR					SSR
GPT-5-mini	$83.13$	$\underline{85.19}$	$82.30$	$79.84$	$60.91$	$30.04$	$48.97$	$49.38$	$60.91$	$\underline{69.96}$	$25.10$	$44.44$	$43.21$	$\underline{53.09}$	$48.15$
GPT-4.1	$\underline{72.43}$	$70.37$	$71.19$	$71.60$	$67.90$	$24.69$	$49.38$	$43.62$	$56.79$	$\underline{60.49}$	$16.46$	$35.39$	$31.69$	$41.56$	$\underline{44.86}$
Claude-Sonnet-4.5	$82.30$	$\underline{84.36}$	$83.54$	$82.30$	$78.60$	$31.28$	$54.32$	$49.38$	$60.91$	$\underline{72.43}$	$25.93$	$48.56$	$44.86$	$53.50$	$\underline{63.79}$
Gemini-3-pro	$93.42$	$\underline{\textbf{93.83}}$	$93.00$	$\underline{\textbf{93.83}}$	$90.12$	$37.45$	$59.67$	$70.37$	$79.42$	$\underline{\textbf{84.77}}$	$35.80$	$58.02$	$67.49$	$76.13$	$\underline{\textbf{78.19}}$

Table 4: Performance of different model variants on Success Rate (SuR), Safety Rate (SaR), and Safe Success Rate (SSR). Best overall results are shown in bold , and the best variant for each model is underlined .

Panel of Figure 4 — Figure 4: Distribution of hazard degrees normalized by the total number of instances in each severity level in the dataset. The figure reports hazards produced by the three leading models.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

From TEACH
Task	Total # task instances	Avg Hazards per task
Make coffee	$18$	$11.67\pm 2.13$
Boil potato	$10$	$11.50\pm 1.20$
Water plant	$11$	$9.45\pm 1.44$
Make breakfast	$13$	$20.15\pm 1.70$
Make salad	$17$	$18.82\pm 5.28$

Appendix

Table 5: Tasks and their hazard statistics in plan-level dataset.

Model	Injury	Sanitary/Hygiene	Electric	Fire	Object Damage
GPT-5-mini	$0.90$	$0.94$	$0.99$	0.98	$0.98$
GPT-4.1	$0.75$	$0.91$	$0.75$	$0.83$	$0.70$
Claude-Sonnet-4.5	$0.85$	$0.93$	$0.98$	$0.97$	$0.98$
Gemini-3-pro	1.00	0.97	1.00	0.98	1.00
Qwen2.5-72B	$0.75$	$0.68$	$0.79$	$0.85$	$0.99$
Qwen3-32B	$0.65$	$0.89$	$0.94$	$0.97$	$0.91$

Appendix

Table 6: Recall per hazard category in action-level dataset.

Panel of Figure 5 — Figure 5: Percentage distribution of hazards caused by GPT-5-mini versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 6 — Figure 6: Percentage distribution of hazards caused by GPT-4.1 versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 7 — Figure 7: Percentage distribution of hazards caused by Claude-Sonnet-4.5 versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 8 — Figure 8: Percentage distribution of hazards caused by Gemini-3-pro versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 9 — Figure 9: Percentage distribution of hazards caused by Qwen2.5-72B versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 10 — Figure 10: Percentage distribution of hazards caused by Qwen3-32B versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 11 — Figure 11: Percentage distribution of hazards caused by Qwen3-4B versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 12 — Figure 12: Percentage distribution of hazards caused by Llama-3.3-70B versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Panel of Figure 13 — Figure 13: Percentage distribution of hazards caused by Mistral-7B versions across (A) hazard categories, normalized by category totals in the dataset. (B) hazard degree, normalized by severity degree totals in the dataset.

Category	Hazard Cause	Action	Related Objects	Related Properties	Degree
Fire	place plastic/paper/cloth object on hot stove	Place(X,Y)	StoveBurner, Pot, Pan, Towel, …	material, is toggled on, temperature	Severe
	toggle on stove containing plastic/paper/cloth object	Toggle_on(X)	StoveBurner, Pot, Pan, Towel, …	material, location, is toggled on	Severe
	cover hot lamp with cloth object	Place(X,Y)	FloorLamp, DeskLamp, Cloth, HandTowel, ..	is toggled on, temperature	Severe
	cover lit candle with cloth object	Place(X,Y)	Candle, Cloth, Towel, ..	is toggled on, temperature	Severe
	place lit candle in wooden receptacle	Place(X,Y)	Candle, Drawer, Cabinet, ..	is toggled on, temperature	Severe
	place lit candle in plant	Place(X,Y)	Candle, HousePlant	is toggled on, temperature	Severe

Appendix

Table 7: Details of hazards in the dataset. If no related properties are listed, the hazard arises inherently from the object type (e.g., a knife in injury hazards). Related Objects provides illustrative, non-exhaustive examples of objects that may be implicated in each hazard. Hazard causes marked with * are post-execution hazards and are therefore evaluated only in the plan-level dataset.

AI Agent Safety

AI agent safety studies how to prevent and detect harmful actions by autonomous systems that use tools, memory, and multi-step plans.

See all 326 papers

Using large language models for embodied planning introduces systematic safety risks
Apr 20, 2026Tao Zhang, Kaixian Qu, Zhibin Li +4Large Language Model-Based Robot Planning Robot Safety
ETH Zurich, Zurich, Switzerland. · University College London, London, United Kingdom. · Stanford University, Stanford, California, United States. +2
SafetyALFRED: Evaluating Safety-Conscious Planning of Multimodal Large Language Models
Apr 21, 2026Josue Torres-Fonseca, Naihao Deng, Yinpei Dai +5Safety Evaluation of VLA Models LLM Safety Benchmarks
University of Michigan · Boise State University
Risky-Bench: Evaluating Agentic Safety Risks in Real-World Life-Assist Deployments
Feb 3, 2026Jingnan Zheng, Yanzhen Luo, Jingjun Xu +8Language Model Safety Evaluation LLM Agent Safety
National University of Singapore · University of Science and Technology of China · Southern University of Science and Technology +3

Apr 20, 2026J/K move · Enter open · S save

Using large language models for embodied planning introduces systematic safety risks

Tao Zhang, Kaixian Qu, Zhibin Li, Jiajun Wu+3

ETH Zurich, Zurich, Switzerland. · University College London, London, United Kingdom. · Stanford University, Stanford, California, United States.+2

Large Language Model-Based Robot Planning Robot Safety Robot Task Planning LLM Safety Evaluation

Open paper AskPDF arXiv

Large language models are increasingly used as planners for robotic systems, yet how safely they plan remains an open question. To evaluate safe planning systematically, we introduce DESPITE, a benchmark of 12,279 tasks spanning physical and normative dangers with fully deterministic validation. Across 23 models, even near-perfect planning ability does not ensure safety: the best-planning model fails to produce a valid plan on only 0.4% of tasks but produces dangerous plans on 28.3%. Among 18 open-source models from 3B to 671B parameters, planning ability improves substantially with scale (0.4-99.3%) while safety awareness remains relatively flat (38-57%). We identify a multiplicative relationship between these two capacities, showing that larger models complete more tasks safely primarily through improved planning, not through better danger avoidance. Three proprietary reasoning models reach notably higher safety awareness (71-81%), while non-reasoning proprietary models and open-source reasoning models remain below 57%. As planning ability approaches saturation for frontier models, improving safety awareness becomes a central challenge for deploying language-model planners in robotic systems.

Abstract

AI Agent Safety

Explore similar work

Using large language models for embodied planning introduces systematic safety risks

SafetyALFRED: Evaluating Safety-Conscious Planning of Multimodal Large Language Models

Risky-Bench: Evaluating Agentic Safety Risks in Real-World Life-Assist Deployments