Robot Coding Agents Ignore Safety Rules Until Given a Harness

"Coding agents" — AI systems in which a large language model writes a robot's control program directly, without robot-specific training — have become a popular way to get robots to perform manipulation tasks. A new paper posted to arXiv asks a question that's gone largely unexamined: are these agents actually safe?

The researchers set up tasks pairing a manipulation goal with a physical obstacle the robot must not touch. In most trials, the coding agent completed the task but still collided with the forbidden obstacle, effectively treating task completion as its only real objective. Notably, the agent's reasoning traces show it does recognize the obstacle, and the prompts explicitly forbid touching it — so the problem isn't perception or unclear instructions. As reported on arXiv, the researchers trace the failure to planning: the stated safety constraint never actually gets prioritized during execution.

Breaking manipulation into two phases exposed where things break down. During the "route" phase — moving toward the target — the agent has no concept of a clearing path around obstacles and can't replan if its chosen route turns out unsafe. During the "contact" phase — the actual grasp or touch — the agent fails to realize the same no-touch constraint still applies.

To address this, the team built SafeHarness, which adds two obstacle-aware components to the coding-agent pipeline. Obstacle-aware route planning represents objects as bounding boxes, generates candidate paths as sequences of waypoints, and has the agent plan, verify, and replan a route before executing it. Obstacle-aware contact execution instead chooses the grasp or touch position so the contact itself steers clear of the obstacle.

In testing, SafeHarness reached 71.9% task success and 87.5% collision avoidance, beating the previous best method by 6.5 and 27.0 percentage points respectively — 2.3 times and 1.5 times the rates of the same underlying agent running without any harness.

The abstract does not specify the robot platform, benchmark suite, or the authors' institutional affiliation beyond the submitting researcher, so those details remain to be confirmed.