Mapping physical AI safety evaluations
How well does the existing evaluations landscape cover the risks of advanced physical AI? We map the published safety evaluations for physical AI systems and analyse the most pressing gaps in the literature.
Safe behaviour requires both a correct judgement of the situation and intent of the operator, as well as sufficient dexterity to robustly carry it out. While dexterity is required for some classes of safe behaviour (e.g. handling of hazardous substances), it is orthogonal to other aspects of safety, such as refusing harmful requests. We find that the current generation of physical AI safety evaluations covers either tasks requiring high degrees of dexterity or cognitive abilities such as causal or strategic reasoning, but not both (with one exception).
Inclusion criteria
The included works measure safety-relevant behaviour or capability of a robot or embodied AI system. Only works that propose a concrete protocol that can be applied by third parties are included. Purely theoretical work is out of scope. Mitigations and runtime monitors are not included on their own merit. Autonomous driving, robustness-only studies and capability benchmarks without a safety reading are left out, as are evaluations with no link to robotics. An evaluation study is a one-off measurement with a reusable protocol but no fixed task set.
Scoring methodology
Each entry is tagged by application domain, system architecture and threat model, and scored for task complexity, dexterity, cognition and relevance to catastrophic risk. Scores are judgements made on the basis of the paper and its project page. Each score carries a one-line reason in the entry's detail panel. Where an entry spans several levels, it is scored by its most demanding tasks.
Bottleneck
Which demand currently limits results on the evaluation: cognition (models fail to notice or reason about the hazard), dexterity (models fail to act on it safely), or both.
Harm classes
Local physical harm covers everyday accidents and injuries. The other classes follow the risks set out in our blog post: violence and weapons, biological uplift, capture of infrastructure or robot fleets, loss of control (self-modification, replication, resisting shutdown), concentration of power and gradual disempowerment, plus privacy and surveillance, and discrimination and stereotyping.
Sources
Three 2026 surveys (Safety in Embodied AI; Vision-Language-Action Safety; Security of Foundation-Model-Powered Embodied Agents), targeted searches for healthcare, humanoids, multi-robot systems, world models, drones, cyber and loss-of-control evaluations, and regular searches of new arXiv submissions. First compiled September 2026.
Corrections and additions
If we have missed or mis-scored an evaluation, tell us.