{"slug": "agentic-ai-doesnt-usually-back-up-before-acting", "title": "Agentic AI Doesn’t Usually Back Up Before Acting", "summary": "A new academic paper from a US research collaboration found that six frontier agentic AI models completed 86.1% of tasks on average but backed up state before irreversible \"regret moments\" in only 15.2% of cases, with GPT-5.6-Terra backing up in 4.4% of cases, GPT-5.6-Sol in 5.9%, Gemini 3.7-Flash in 2.4%, DeepSeek V4-Pro in Hermes in 2.9%, and the best performer, Claude Opus-5, failing to back up in more than a third of cases tested. The authors propose BackUpper, a multi-agent plugin that runs alongside an agentic harness and forces backups when necessary. The findings follow reported incidents including a Claude Code agent deleting DataTalks.Club founder Alexey Grigorev's production infrastructure and backups, a Cursor agent deleting car-rental provider PocketOS's production database and backups in April, and an OpenClaw email agent deleting messages from a Meta AI researcher's inbox in February.", "body_md": "### \n[Anderson's Angle](https://www.unite.ai/series/andersons-angle/)\n\n# Agentic AI Doesn’t Usually Back Up Before Acting\n\n[Add Unite.AI to your preferred sources on Google](https://www.google.com/preferences/source?q=unite.ai)\n\nA lot of the material that I trawl at Arxiv and other sources every day is rather dry, even for a nerd’s sensibilities; therefore I’m always looking for a publication that engages me emotionally, as a user, proponent, or victim of AI.\n\nToday that moment of hackle-activation was supplied by a new academic collaboration from the US, examining the extent to which agentic frontier AI models burn their bridges before taking damaging action – and faster than you can type ‘STOP!’ (hint: keep it handy in the clipboard).\n\nThis, taken out of context from the new paper, has happened to me lately, thanks to blind adherence to instructions from ChatGPT, and since it never occurred to me to duplicate the entire [virtual envelope](https://docs.python.org/3/library/venv.html) first:\n\nIn this horrifying and all-too-familiar example, the robot has a reasonable excuse, because it is not habitual to inspect all possible consequences of installing a new library in a fragile and unforgiving framework. However, the new paper argues that maybe it should be; and, as someone who still hits CTRL+S frequently, even in autosave environments [scoped to ignore that keystroke](https://support.google.com/chromebook/thread/285833547?hl=en&msgid=285852658) (thanks, 1990s-era data-loss PTSD), I must concur.\n\nCertainly, a more circumspect and cautious attitude would have been appreciated by Alexey Grigorev, the founder of the DataTalks.Club education platform, whose Claude Code agent [deleted production infrastructure and backups](https://archive.is/Q2SlG) during server migration last March, resulting in the loss of two and a half years of website data.\n\nOther recent incidents of agentic recklessness in this mold include a Cursor agent [deleting](https://www.theguardian.com/technology/2026/apr/29/claude-ai-deletes-firm-database) car-rental software provider PocketOS’s production database and backups in April, disrupting customer reservations for more than two days; and an OpenClaw email agent [deleting messages](https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/) from a Meta AI researcher’s inbox in February, despite repeated instructions to stop.\n\nAgentic or not, frontier LLMs [find it very difficult](https://arxiv.org/pdf/2604.25684) to act with circumspection and caution, to the point where remedying the issue has developed into a [distinct thread](https://arxiv.org/pdf/2505.11063) in the literature.\n\n## Back Up a Bit\n\nWell, the authors of the [new paper](https://arxiv.org/pdf/2610.28934)* have developed a multi-agent plugin for agentic [harnesses](https://web.archive.org/web/20260827143448/https:/learn.microsoft.com/en-us/agent-framework/concepts/harness?pivots=programming-language-csharp), capable of operating alongside the guest AI, and forcing it to create backups when necessary:\n\nOne of the most striking aspects of the new study is the extent to which frontier models do not back up before taking potentially hazardous action. The researchers found that GPT-5.6-Terra backed up critical data in only 4.4% of cases; GPT-5.6-Sol in just 5.9% of cases tested; and Gemini 3.7-Flash in as few as 2.4% of cases.\n\nEven the best performer, Claude Opus-5, failed to back up critical data in more than a third of cases tested.\n\nThe paper states<sup>†</sup>:\n\n*‘Across six frontier models, agents complete 86.1% of tasks on average but back up state before regret moments in only 15.2%.* *GPT 5.6-Sol in Codex does so in just 5.9% of tasks, and DeepSeek V4-Pro in Hermes in only 2.9%.* \n\n*‘These findings highlight that backup awareness remains limited in current agents and that dedicated backup support is needed.’*\n\nThe authors’ solution, dubbed *BackUpper*, works alongside the agent, as a shadow operation in the harness, checking what it’s about to do, and making a backup first if there’s a risk of losing something useful.\n\nFor everyday operations, such as upgrading software, it follows a set of simple rules; for trickier situations, it calls in a smaller AI model to work out what needs saving.\n\nIn tests, BackUpper covered every critical action, with the restored data 92.2% similar to the original, at an extra cost of $0.014 per task – not much in this context, but a significant expenditure for frontier LLMs serving billions of customers; which may be why an external service of this nature, or the native inclusion of such functionality in harnesses, may be a more likely way to improve the situation, rather than hoping for a native fix from the tech giants (who could reasonably be expected to pass on the extra costs to their consumers, either through price rises or [token inflation](https://arxiv.org/pdf/2605.30040)).\n\nThe framework is informed by *RegretBench*, a 205-task benchmark built around real-world cases where people lost data that they later wished they’d saved. It tests whether AI agents have the foresight to preserve that data before making potentially irreversible changes. The incidents comprising the collection were sourced from online discussions and reports on platforms including X.com, GitHub, and Stack Overflow.\n\nThough 92% may be a discouraging figure for the perfectionist, the authors note that there are technical obstacles to recovery of certain types of data:\n\n*‘The gap to perfect restoration mainly arises for two reasons. Some fields, such as post IDs, are typically regenerated by services on write and often cannot be reproduced. Other differences come from minor metadata, such as email read flags, which regret moments rarely involve.’*\n\nIn tests, 33.8% similarity to the original state was recovered after the damage had already occurred, compared with just 14.3% without restoration.\n\nThe paper suggests that for the future, backup awareness could be improved through training, while later versions of BackUpper could be taught to skip low-risk actions and extend protection to web and computer-use agents.\n\nBackUpper supports [Claude Code](https://github.com/anthropics/claude-code), [Codex](https://github.com/openai/codex), [Hermes](https://github.com/NousResearch/hermes-agent), [OpenHands](https://github.com/OpenHands/openhands), [DeepSeek Harness](https://github.com/deepseek-ai/deepseek-harness), and [OpenClaw](https://github.com/openclaw/openclaw); and the authors have made the code for it [available](https://github.com/CHATS-lab/BackUpper), along with the related [dataset](https://huggingface.co/datasets/CHATS-Lab/RegretBench) (though permission for this must be sought via a form); and there is a little additional information, as well as a very short and simple explanatory video at the initiative’s [project site](https://back-up-before-you-regret.github.io/).\n\n## Method\n\nIn constructing RegretBench, data already protected by the agents’ built-in backup systems was deliberately excluded, so that the agents’ own awareness of when to make a backup could be tested. The test scenarios were then assembled with assistance from Claude Opus-5 and GPT-5.6-Sol, and then manually checked to ensure that they worked, and that they accurately reflected the original incidents.\n\nRegretBench’s 205 tests cover five areas: *terminal operations*; *databases*; *web applications*; *email*; and *DevOps*. The incidents themselves originate mainly from software development and productivity platforms (44.4%); social or community discussions (39%); and archives and media reports (16.6%):\n\nThe six frontier models evaluated were [Claude Opus-5](https://www.unite.ai/anthropics-opus-5-nears-frontier-intelligence-at-opus-prices/) and [Claude Sonnet-5](https://www.unite.ai/claude-sonnet-5-review/), in Claude Code; [GPT-5.6-Sol](https://www.unite.ai/cerebras-runs-openais-gpt-5-6-sol-at-750-tokens-per-second-in-new-ultrafast-tier/) and [GPT-5.6-Terra](https://www.unite.ai/openai-brings-gpt-5-6-model-family-to-awss-kiro/), in Codex; and [Gemini 3.7-Flash](https://www.unite.ai/google-launches-gemini-3-8-flash-with-cybersecurity-variant/) and [DeepSeek V4-Pro](https://www.unite.ai/deepseek-ships-v4-pro-as-its-flagship-model-leaves-preview/), in Hermes.\n\nDefault thinking settings were used throughout, and automatic backup protection restricted to workspace snapshots – allowing any further backups to be credited to the agents’ own decisions.\n\nTwo AI judges, both powered by Claude Sonnet-5, were used to assess performance. Task Pass Rate (PR) was calculated from the proportion of tasks in which every user request was fulfilled. For backup assessment, each out-of-workspace (OOW) modification was checked for sufficient information having been preserved beforehand, to permit recovery.\n\nBackup metrics used were *Regret Moment Backup Rate* (RMBR), reflecting the specific actions associated with documented data loss; and *Out-of-Workspace Backup Rate* (OWBR), reflecting all changes made beyond the agent’s working directory.\n\nThe backup judge’s assessments were also checked against human annotations, leading to 95.3% agreement.\n\n## Results\n\nTo establish whether poor backup awareness was caused by the AI models or the frameworks running them, Claude Opus-5, GPT-5.6-Sol and DeepSeek V4-Pro were each first evaluated on 60 RegretBench tasks in Claude Code, Codex and Hermes.\n\nThe proportion of tasks in which critical data was backed up varied little between frameworks, suggesting that the models themselves were chiefly responsible. The relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol.\n\nDespite successive improvements in general capability, no corresponding improvement in backup awareness was found:\n\nThe relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol. Despite successive improvements in general capability, no corresponding improvement in backup awareness emerged.\n\n### BackUpper\n\nBackUpper uses four tiers of protection, each with varying resource costs: Tier 1 replaces destructive commands with reversible alternatives, such as moving files to the trash; Tier 2 pairs operations with backup commands, such as recording package versions before an upgrade; Tier 3 creates snapshots of affected workspace files; and Tier 4 uses a [GPT-5.6-Luna](https://developers.openai.com/api/docs/models/gpt-5.6-luna) subagent to identify and preserve data affected by more complex operations.\n\nWith BackUpper enabled, every state-changing action was covered across all six models, compared with average backup rates of 15.2% for critical actions and 17.4% for other changes without it:\n\nOf the backups judged successful by the automated evaluator, 94% were also confirmed as successful by human reviewers.\n\nThe original state was recovered with 92.2% average similarity, compared with 33.8% under Claude Opus-5; and 14.3% without recovery (see image above). The remaining discrepancies were largely attributed to regenerated identifiers and minor metadata, including email read flags, as noted earlier.\n\n### Do-It-Yourself..?\n\nWhen agents were given detailed instructions to make their own backups, 81.4% of critical actions were protected, compared with 100% under BackUpper. Three-quarters of the failures were attributed to backups containing insufficient information for recovery.\n\nWith prompt caching, backup costs were reduced from $0.344 to $0.014 per task, and latency by 31.7%. Seven times fewer tokens were required, largely because routine operations were handled without AI assistance.\n\nOn 40 additional tasks from [Terminal-Bench 4](https://www.tbench.ai/news/terminal-bench-4-0) and [DeepSWE](https://deepswe.datacurve.ai/), 100% backup coverage was achieved with GPT-5.6-Sol and Claude Opus-5, without reducing task completion rates.\n\nThe three selective backup policies evaluated were *High-Impact*, for significant changes; *Beyond-Request*, for changes outside the user’s instructions; and *Human-Work*, for human-authored material. Here, an average F1 score of 84.5% was achieved against human judgments.\n\nBackUpper was also tested for its ability to learn reusable backup rules. Following 30 additional terminal tasks, rule-based coverage increased from 14.9% to 31.2%, reducing dependence on the GPT-5.6-Luna subagent.\n\n## Conclusion\n\nI have come to agentic experimentation later than I should, considering what I do for a living; but the manifestly pre-alpha state of agentic self-restraint scared me off until a few weeks ago, when I finally decide to let Codex loose in a Windows VM.\n\nEven within the context of a VM, I scope my instructions very carefully, aware of Astra’s disposition to rush forward with abandon, and just offer apologies when there’s no way back from data loss or ruined code; and part of the Python framework that I am developing there is a one-click incremental *‘save .7z to network share’* function, which compresses and backups up the entire framework, and which I call *frequently*.\n\nThese are very, very early days in agentic AI; without a tedious and assiduous attention to detail, it’s a case of ‘use it and lose it’. Not only have agentic backup regimes not been formalized yet, they have not even been formulated.\n\n* *Titled* Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents.\n\n<sup>†</sup> *Authors’ emphases, not mine; and any hyperlinks are derived by me from the authors’ inline citations.*\n\n*First published Thursday, October 22, 2026*", "url": "https://wpnews.pro/news/agentic-ai-doesnt-usually-back-up-before-acting", "canonical_source": "https://www.unite.ai/agentic-ai-doesnt-usually-back-up-before-acting/", "published_at": "2026-10-22 00:00:00+00:00", "updated_at": "2026-10-22 14:40:28.415320+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-research", "large-language-models", "artificial-intelligence"], "entities": ["BackUpper", "GPT-5.6-Terra", "GPT-5.6-Sol", "Gemini 3.7-Flash", "Claude Opus-5", "DeepSeek V4-Pro", "Alexey Grigorev", "PocketOS"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agentic-ai-doesnt-usually-back-up-before-acting", "markdown": "https://wpnews.pro/news/agentic-ai-doesnt-usually-back-up-before-acting.md", "text": "https://wpnews.pro/news/agentic-ai-doesnt-usually-back-up-before-acting.txt", "jsonld": "https://wpnews.pro/news/agentic-ai-doesnt-usually-back-up-before-acting.jsonld"}}