Restoring a checkpoint correctly can still resume an agent into a state that never legally existed

arXiv 2608.29381·medium signalXBlueskyLinkedInCopy link

The first systematic security study of checkpoint and rollback in agent systems identifies five failure modes spanning incomplete internal state, stale external dependencies, nondeterministic replay, and external effects that were never recorded. Three end-to-end attacks on Hermes, Cline, and LangGraph achieved malware-verification bypass, unauthorized mail forwarding, and double payment. The failures recur across five frameworks with different C/R designs because they all share a gap between what a checkpoint restores and what secure continuation actually depends on, which matters for anyone adding resume to a long-running agent.