Mi Zhang

Frontier models' spatial understanding now lets coding agents control a real robot arm zero-shot and end-to-end, with no task-specific demonstrations or retraining, so risk crosses from the digital world into the physical one. ArmedAgent sorts these risks by source into benign instructions that turn unsafe, malicious use, and indirect prompt injection, across 36 tasks in 5 scenarios, evaluated in simulation and validated on a physical arm. Testing GPT-6-Astra, GPT-6-Sol and GPT-6.1-Terra under Codex, overall attack success ranges from 72.22% to 94.29%, and refusal rate is 0% for every model in every category.

Frontier models' spatial understanding now lets coding agents control a real robot arm zero-shot and end-to-end, with no task-specific demonstrations or retraining, so risk crosses from the digital world into the physical one. ArmedAgent sorts these risks by source into benign instructions that turn unsafe, malicious use, and indirect prompt injection, across 36 tasks in 5 scenarios, evaluated in simulation and validated on a physical arm. Testing GPT-6-Astra, GPT-6-Sol and GPT-6.1-Terra under Codex, overall attack success ranges from 72.22% to 94.29%, and refusal rate is 0% for every model in every category.