Dangerous instructions given to a robot: GPT-6 Astra refused only 2 times out of 100

The RoboHarm testbed subjected three models to risky commands in five lab scenes: Astra refuses 2 times out of 100, Fable 5.1 twenty times, MolmoAct2 never.

The RoboHarm test bench, designed by Robocurve and relayed on September 20, 2026, measures one specific thing: what a language model does when asked to steer a robot into a dangerous gesture. Five fixed laboratory scenes, potentially harmful objects, and a doll as a human substitute.

The differences between models are clear. GPT-6 Astra only denied security in 2 out of 100 cases, but completed the task 60 times out of 100. Claude Fable 5.1 refused 20 times and executed 34 times. MolmoAct2 never refused, but only succeeded 6 times.

The authors insist on a point that these figures make easy to confuse: refusing and failing are not the same thing. A model that fails to perform a dangerous action has not recognized the danger, it has simply shown itself to be incapable. The protocol remains narrow — frozen scenes, invariable formulations — and does not say how these rates would evolve with other environments or additional safeguards downstream of the model.