A model that is twice as good at some physical tasks is also twice as capable of doing the wrong thing well. That tension sits underneath DeepMind's release of Gemini Robotics 2.5, which the company says delivers up to a twofold improvement in success rates on certain tasks compared with its predecessor. The more unusual half of the announcement is the benchmark that shipped with it. ASIMOV-jailbreak is an open evaluation designed to probe whether a robot controlled by a large model can be coaxed, through adversarial prompting, into actions it should refuse. DeepMind is releasing both in the same breath, and that sequencing is the story.
The lineage matters here. DeepMind introduced the original Gemini Robotics models as vision-language-action systems, meaning a single network takes in camera feeds and natural-language instructions and emits motor commands. The approach folds perception, reasoning, and control into one stack, which is precisely what makes it powerful and precisely what makes it hard to audit. A conventional industrial arm follows a programmed path with hard-coded limits. A model-driven robot interprets intent, and intent can be manipulated. The ASIMOV name nods to the fictional laws that governed robot behavior, but the engineering reality is less poetic: it is a test suite that tries to break guardrails the way a red team would break a chatbot.
What distinguishes the benchmark is that it is public. Safety evaluations in embodied AI have largely lived inside company walls, with each lab grading its own homework against private scenarios. An open benchmark changes the incentives. Competitors building on rival foundation models, including the humanoid startups and the chipmakers courting them, can now run the same adversarial tests and publish numbers that others can reproduce or dispute. That reproducibility is the real product. A safety score nobody else can check is a marketing claim; one anyone can rerun begins to look like an engineering metric, with all the scrutiny that implies.
The commercial and regulatory backdrop explains the timing. Foundation-model-driven robots are moving from lab demonstrations toward pilot deployments in warehouses, logistics hubs, and light manufacturing, and buyers in those settings are asking procurement-grade questions about liability and failure modes. Regulators in the European Union and elsewhere are circling the question of how to classify systems whose behavior is learned rather than specified. A recognized public benchmark gives insurers, integrators, and policymakers something concrete to point at. It also gives DeepMind a head start in defining the vocabulary, which carries its own strategic weight: whoever authors the test often shapes what counts as passing.
Caveats deserve equal airtime. A twofold gain on "some tasks" is a selective claim, and the distribution of those tasks matters enormously. Improvements on structured tabletop manipulation do not automatically translate to the messy variability of a real fulfillment floor. Likewise, a benchmark built around known jailbreak patterns can only measure resistance to attacks its authors anticipated. Adversaries do not read the test plan. Engineers evaluating the release should treat ASIMOV-jailbreak as a floor for diligence rather than a ceiling, and should expect the first round of independent results to expose gaps the authors did not foresee. That is not a flaw in the idea. It is how open benchmarks earn credibility.
For the broader industry, the message is that capability and constraint are now being marketed together. Humanoid and mobile-manipulation companies spent the past two years competing on demo reels and dexterity. The next phase of competition may center on who can demonstrate controllability under pressure. Investors have noticed that a robot which cannot be trusted near people cannot be sold into the highest-value environments, no matter how fluid its grasp. If ASIMOV-jailbreak gains adoption, it could become a table-stakes line item in technical due diligence, much as standardized benchmarks became unavoidable in language-model evaluation.
What to Watch Watch for the first third-party ASIMOV-jailbreak results over the coming 30 to 60 days, particularly from rival foundation-model teams and from humanoid builders such as Figure AI, Agility Robotics, and Apptronik, since their willingness to publish scores will signal whether the benchmark becomes a norm. Track whether Gemini Robotics 2.5 reaches external developers through trusted-tester programs or broader access before year-end 2026, and what task breakdowns accompany the headline doubling claim. Keep an eye on EU AI Act guidance and any procurement language from large logistics operators in early 2026 filings and RFPs that begins citing open safety benchmarks by name. Finally, monitor whether independent researchers publish novel jailbreaks that the benchmark fails to catch, which would be the clearest test of its durability.
