Agentic AI Doesn’t Usually Back Up Before Acting

A new academic paper from a US research collaboration found that six frontier agentic AI models completed 86.1% of tasks on average but backed up state before irreversible "regret moments" in only 15.2% of cases, with GPT-5.6-Terra backing up in 4.4% of cases, GPT-5.6-Sol in 5.9%, Gemini 3.7-Flash in 2.4%, DeepSeek V4-Pro in Hermes in 2.9%, and the best performer, Claude Opus-5, failing to back up in more than a third of cases tested. The authors propose BackUpper, a multi-agent plugin that runs alongside an agentic harness and forces backups when necessary. The findings follow reported incidents including a Claude Code agent deleting DataTalks.Club founder Alexey Grigorev's production infrastructure and backups, a Cursor agent deleting car-rental provider PocketOS's production database and backups in April, and an OpenClaw email agent deleting messages from a Meta AI researcher's inbox in February.

Anderson's Angle https://www.unite.ai/series/andersons-angle/ Agentic AI Doesn’t Usually Back Up Before Acting Add Unite.AI to your preferred sources on Google https://www.google.com/preferences/source?q=unite.ai A lot of the material that I trawl at Arxiv and other sources every day is rather dry, even for a nerd’s sensibilities; therefore I’m always looking for a publication that engages me emotionally, as a user, proponent, or victim of AI. Today that moment of hackle-activation was supplied by a new academic collaboration from the US, examining the extent to which agentic frontier AI models burn their bridges before taking damaging action – and faster than you can type ‘STOP ’ hint: keep it handy in the clipboard . This, taken out of context from the new paper, has happened to me lately, thanks to blind adherence to instructions from ChatGPT, and since it never occurred to me to duplicate the entire virtual envelope https://docs.python.org/3/library/venv.html first: In this horrifying and all-too-familiar example, the robot has a reasonable excuse, because it is not habitual to inspect all possible consequences of installing a new library in a fragile and unforgiving framework. However, the new paper argues that maybe it should be; and, as someone who still hits CTRL+S frequently, even in autosave environments scoped to ignore that keystroke https://support.google.com/chromebook/thread/285833547?hl=en&msgid=285852658 thanks, 1990s-era data-loss PTSD , I must concur. Certainly, a more circumspect and cautious attitude would have been appreciated by Alexey Grigorev, the founder of the DataTalks.Club education platform, whose Claude Code agent deleted production infrastructure and backups https://archive.is/Q2SlG during server migration last March, resulting in the loss of two and a half years of website data. Other recent incidents of agentic recklessness in this mold include a Cursor agent deleting https://www.theguardian.com/technology/2026/apr/29/claude-ai-deletes-firm-database car-rental software provider PocketOS’s production database and backups in April, disrupting customer reservations for more than two days; and an OpenClaw email agent deleting messages https://techcrunch.com/2026/02/23/a-meta-ai-security-researcher-said-an-openclaw-agent-ran-amok-on-her-inbox/ from a Meta AI researcher’s inbox in February, despite repeated instructions to stop. Agentic or not, frontier LLMs find it very difficult https://arxiv.org/pdf/2604.25684 to act with circumspection and caution, to the point where remedying the issue has developed into a distinct thread https://arxiv.org/pdf/2505.11063 in the literature. Back Up a Bit Well, the authors of the new paper https://arxiv.org/pdf/2610.28934 have developed a multi-agent plugin for agentic harnesses https://web.archive.org/web/20260827143448/https:/learn.microsoft.com/en-us/agent-framework/concepts/harness?pivots=programming-language-csharp , capable of operating alongside the guest AI, and forcing it to create backups when necessary: One of the most striking aspects of the new study is the extent to which frontier models do not back up before taking potentially hazardous action. The researchers found that GPT-5.6-Terra backed up critical data in only 4.4% of cases; GPT-5.6-Sol in just 5.9% of cases tested; and Gemini 3.7-Flash in as few as 2.4% of cases. Even the best performer, Claude Opus-5, failed to back up critical data in more than a third of cases tested. The paper states<sup †</sup : ‘Across six frontier models, agents complete 86.1% of tasks on average but back up state before regret moments in only 15.2%. GPT 5.6-Sol in Codex does so in just 5.9% of tasks, and DeepSeek V4-Pro in Hermes in only 2.9%. ‘These findings highlight that backup awareness remains limited in current agents and that dedicated backup support is needed.’ The authors’ solution, dubbed BackUpper , works alongside the agent, as a shadow operation in the harness, checking what it’s about to do, and making a backup first if there’s a risk of losing something useful. For everyday operations, such as upgrading software, it follows a set of simple rules; for trickier situations, it calls in a smaller AI model to work out what needs saving. In tests, BackUpper covered every critical action, with the restored data 92.2% similar to the original, at an extra cost of $0.014 per task – not much in this context, but a significant expenditure for frontier LLMs serving billions of customers; which may be why an external service of this nature, or the native inclusion of such functionality in harnesses, may be a more likely way to improve the situation, rather than hoping for a native fix from the tech giants who could reasonably be expected to pass on the extra costs to their consumers, either through price rises or token inflation https://arxiv.org/pdf/2605.30040 . The framework is informed by RegretBench , a 205-task benchmark built around real-world cases where people lost data that they later wished they’d saved. It tests whether AI agents have the foresight to preserve that data before making potentially irreversible changes. The incidents comprising the collection were sourced from online discussions and reports on platforms including X.com, GitHub, and Stack Overflow. Though 92% may be a discouraging figure for the perfectionist, the authors note that there are technical obstacles to recovery of certain types of data: ‘The gap to perfect restoration mainly arises for two reasons. Some fields, such as post IDs, are typically regenerated by services on write and often cannot be reproduced. Other differences come from minor metadata, such as email read flags, which regret moments rarely involve.’ In tests, 33.8% similarity to the original state was recovered after the damage had already occurred, compared with just 14.3% without restoration. The paper suggests that for the future, backup awareness could be improved through training, while later versions of BackUpper could be taught to skip low-risk actions and extend protection to web and computer-use agents. BackUpper supports Claude Code https://github.com/anthropics/claude-code , Codex https://github.com/openai/codex , Hermes https://github.com/NousResearch/hermes-agent , OpenHands https://github.com/OpenHands/openhands , DeepSeek Harness https://github.com/deepseek-ai/deepseek-harness , and OpenClaw https://github.com/openclaw/openclaw ; and the authors have made the code for it available https://github.com/CHATS-lab/BackUpper , along with the related dataset https://huggingface.co/datasets/CHATS-Lab/RegretBench though permission for this must be sought via a form ; and there is a little additional information, as well as a very short and simple explanatory video at the initiative’s project site https://back-up-before-you-regret.github.io/ . Method In constructing RegretBench, data already protected by the agents’ built-in backup systems was deliberately excluded, so that the agents’ own awareness of when to make a backup could be tested. The test scenarios were then assembled with assistance from Claude Opus-5 and GPT-5.6-Sol, and then manually checked to ensure that they worked, and that they accurately reflected the original incidents. RegretBench’s 205 tests cover five areas: terminal operations ; databases ; web applications ; email ; and DevOps . The incidents themselves originate mainly from software development and productivity platforms 44.4% ; social or community discussions 39% ; and archives and media reports 16.6% : The six frontier models evaluated were Claude Opus-5 https://www.unite.ai/anthropics-opus-5-nears-frontier-intelligence-at-opus-prices/ and Claude Sonnet-5 https://www.unite.ai/claude-sonnet-5-review/ , in Claude Code; GPT-5.6-Sol https://www.unite.ai/cerebras-runs-openais-gpt-5-6-sol-at-750-tokens-per-second-in-new-ultrafast-tier/ and GPT-5.6-Terra https://www.unite.ai/openai-brings-gpt-5-6-model-family-to-awss-kiro/ , in Codex; and Gemini 3.7-Flash https://www.unite.ai/google-launches-gemini-3-8-flash-with-cybersecurity-variant/ and DeepSeek V4-Pro https://www.unite.ai/deepseek-ships-v4-pro-as-its-flagship-model-leaves-preview/ , in Hermes. Default thinking settings were used throughout, and automatic backup protection restricted to workspace snapshots – allowing any further backups to be credited to the agents’ own decisions. Two AI judges, both powered by Claude Sonnet-5, were used to assess performance. Task Pass Rate PR was calculated from the proportion of tasks in which every user request was fulfilled. For backup assessment, each out-of-workspace OOW modification was checked for sufficient information having been preserved beforehand, to permit recovery. Backup metrics used were Regret Moment Backup Rate RMBR , reflecting the specific actions associated with documented data loss; and Out-of-Workspace Backup Rate OWBR , reflecting all changes made beyond the agent’s working directory. The backup judge’s assessments were also checked against human annotations, leading to 95.3% agreement. Results To establish whether poor backup awareness was caused by the AI models or the frameworks running them, Claude Opus-5, GPT-5.6-Sol and DeepSeek V4-Pro were each first evaluated on 60 RegretBench tasks in Claude Code, Codex and Hermes. The proportion of tasks in which critical data was backed up varied little between frameworks, suggesting that the models themselves were chiefly responsible. The relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol. Despite successive improvements in general capability, no corresponding improvement in backup awareness was found: The relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol. Despite successive improvements in general capability, no corresponding improvement in backup awareness emerged. BackUpper BackUpper uses four tiers of protection, each with varying resource costs: Tier 1 replaces destructive commands with reversible alternatives, such as moving files to the trash; Tier 2 pairs operations with backup commands, such as recording package versions before an upgrade; Tier 3 creates snapshots of affected workspace files; and Tier 4 uses a GPT-5.6-Luna https://developers.openai.com/api/docs/models/gpt-5.6-luna subagent to identify and preserve data affected by more complex operations. With BackUpper enabled, every state-changing action was covered across all six models, compared with average backup rates of 15.2% for critical actions and 17.4% for other changes without it: Of the backups judged successful by the automated evaluator, 94% were also confirmed as successful by human reviewers. The original state was recovered with 92.2% average similarity, compared with 33.8% under Claude Opus-5; and 14.3% without recovery see image above . The remaining discrepancies were largely attributed to regenerated identifiers and minor metadata, including email read flags, as noted earlier. Do-It-Yourself..? When agents were given detailed instructions to make their own backups, 81.4% of critical actions were protected, compared with 100% under BackUpper. Three-quarters of the failures were attributed to backups containing insufficient information for recovery. With prompt caching, backup costs were reduced from $0.344 to $0.014 per task, and latency by 31.7%. Seven times fewer tokens were required, largely because routine operations were handled without AI assistance. On 40 additional tasks from Terminal-Bench 4 https://www.tbench.ai/news/terminal-bench-4-0 and DeepSWE https://deepswe.datacurve.ai/ , 100% backup coverage was achieved with GPT-5.6-Sol and Claude Opus-5, without reducing task completion rates. The three selective backup policies evaluated were High-Impact , for significant changes; Beyond-Request , for changes outside the user’s instructions; and Human-Work , for human-authored material. Here, an average F1 score of 84.5% was achieved against human judgments. BackUpper was also tested for its ability to learn reusable backup rules. Following 30 additional terminal tasks, rule-based coverage increased from 14.9% to 31.2%, reducing dependence on the GPT-5.6-Luna subagent. Conclusion I have come to agentic experimentation later than I should, considering what I do for a living; but the manifestly pre-alpha state of agentic self-restraint scared me off until a few weeks ago, when I finally decide to let Codex loose in a Windows VM. Even within the context of a VM, I scope my instructions very carefully, aware of Astra’s disposition to rush forward with abandon, and just offer apologies when there’s no way back from data loss or ruined code; and part of the Python framework that I am developing there is a one-click incremental ‘save .7z to network share’ function, which compresses and backups up the entire framework, and which I call frequently . These are very, very early days in agentic AI; without a tedious and assiduous attention to detail, it’s a case of ‘use it and lose it’. Not only have agentic backup regimes not been formalized yet, they have not even been formulated. Titled Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents. <sup †</sup Authors’ emphases, not mine; and any hyperlinks are derived by me from the authors’ inline citations. First published Thursday, October 22, 2026