Restoring a checkpoint correctly can resume an agent into a state that never legally existed.

The first systematic security study of agent checkpoint and rollback identifies five failure modes across incomplete internal state, stale external dependencies, nondeterministic replay, and external effects never recorded (arXiv 2608.29381). Three end-to-end attacks on Hermes, Cline and LangGraph achieved malware-verification bypass, unauthorized mail forwarding, and double payment. The failures recur across five frameworks with different designs because they share one gap: what a checkpoint restores versus what secure continuation depends on. Directly relevant if you are adding resume to anything long-running.