AI Agent Checkpoint Rollback Can Turn Into an Attack

The first systematic study of checkpoint/rollback security in AI agents has been published on arXiv, showing that a correct rollback does not guarantee a safe recovery: without checkpoint spoofing, it is possible to bypass malicious code checks in Hermes, unauthorized email forwarding in Cline, and double payment in LangGraph.

Compiled by Sergey KostenchukPublished 2026-09-01Updated 2026-09-18

2026-09-01 Research Google

🤖 Checkpoint rollback can open an attack on an AI agent

The paper “Safe to Resume?” (arXiv:2608.29381) has been published on arXiv — the first systematic study of checkpoint/rollback security in AI agents. 12 systems were analyzed; three attacks without checkpoint spoofing were found: bypassing malicious code checks in Hermes, email forwarding in Cline, and double payment in LangGraph.

🌍 In a 2026 survey, 79% of companies rolled back agent actions, and 42% lost money. None of the 12 C/R mechanisms covers external effects: payments, emails, and databases cannot be rolled back. The paper is currently a preprint, with no replications.

👤 Working with Cline, Hermes, Gemini CLI, or LangGraph checkpoints? Do not consider rollback safe: it can glue old state with new agent outputs. After a failure, restart scans and tests from scratch and check whether an email or payment has gone out.

Source 1: https://arxiv.org/abs/2608.29381 Source 2: https://arxiv.org/html/2608.29381v1

Sources