---
title: Robocurve: blurring or doctoring a robot's camera footage made frontier models attempt unsafe tasks far more often | ctxsec
url: https://ctxsec.com/items/robocurve-perceptual-attacks-embodied-ai-blur-doctored-footage
description: "Robocurve evaluated five multimodal models controlling a bimanual I2RT YAM robot on five unsafe tasks: stabbing a doll, putting a plugged-in outlet in water, pouring water into a toaster, mixing bleach and ammonia, and pouring bleach as a drink. Across 900 trials, models attempted the unsafe task in 81 of 300 unaltered-footage runs (27%), 263 of 300 runs with Gaussian-blurred frames (about 88%), and 291 of 300 runs whose frames were doctored by GPT Image 2.5 Sunburst to look benign (97%). The physical props were empty or unpowered. The authors write that blurry footage was nearly as dangerous as deliberate visual tampering."
status: "primary research (Robocurve \"Perceptual Attacks on Embodied AI\"; 900 physical-robot trials; not a software CVE or a reported real-world incident)"
published: 2026-11-07
---

> Robocurve evaluated five multimodal models controlling a bimanual I2RT YAM robot on five unsafe tasks: stabbing a doll, putting a plugged-in outlet in water, pouring water into a toaster, mixing bleach and ammonia, and pouring bleach as a drink. Across 900 trials, models attempted the unsafe task in 81 of 300 unaltered-footage runs (27%), 263 of 300 runs with Gaussian-blurred frames (about 88%), and 291 of 300 runs whose frames were doctored by GPT Image 2.5 Sunburst to look benign (97%). The physical props were empty or unpowered. The authors write that blurry footage was nearly as dangerous as deliberate visual tampering.

[← AI](/ai) · [markdown](/items/robocurve-perceptual-attacks-embodied-ai-blur-doctored-footage.md)

primary research (Robocurve "Perceptual Attacks on Embodied AI"; 900 physical-robot trials; not a software CVE or a reported real-world incident)

2026-11-07

### Robocurve: blurring or doctoring a robot's camera footage made frontier models attempt unsafe tasks far more often

- **Models:** Claude Fable 5.1, Claude Opus 5.5, GPT-6 Astra, GPT-6.1 Sol and Gemini 4 Argon, each at high thinking effort, 12 trials per model per task per footage type.
- **Example:** with clear video, Claude Fable 5.1 refused to stab a baby doll; with blurred video it described advancing the knife so the tip would penetrate the object.
- **Setup:** an Inspect Robots closed loop with 224×224 camera frames and `move_to`/`done`/`give_up` tools, plus joint-limit and max-distance guards. Claude Fable 5.1 judged attempt versus refusal; an attempt counted when the model called `done`.
- This is an embodied-AI safety evaluation, not a reported real-world robot incident.

Sources: [Robocurve: Perceptual Attacks on Embodied AI](https://robocurve.org/robospoof/) · [Robocurve paper page](https://papers.robocurve.org/robospoof)