UNDO: A Recoverability Layer for Tool-Using AI Agents

Tool-using AI agents increasingly take actions that are hard to take back: they delete files, rewritedatabases, send email and move money. Documented incidents show agents doing so by mistake orafter obeying instructions hidden in the data they read. The prevailing safeguard, asking a person toapprove actions, is weakened by approval fatigue: users of one widely deployed coding agent approve93% of its permission prompts. We present UNDO, a runtime that interposes between an agent and itstools and treats each task as a recoverable transaction. UNDO classifies every call as reversible, compensable or irreversible from its arguments, its recipients and, for raw commands, its dry-run effects; itjournals and stages reversible effects, holds outgoing emails and payments in a cancellable window, requests human approval only for irreversible calls, and, when the task ends, lets a verifier that combinesrules with a separate judge model commit the work or roll it all back. We also introduce TakeBack, abenchmark of 62 tasks in a simulated company, motivated by nine documented incidents and includingprompt-injection attacks, look-alike task pairs and a sealed test set written after every tunable settingwasfrozen; its answer keys are never visible to the runtime. Across 3,020 agent runs with a 120-billionparameter agent model and 570 paired replay runs, UNDO reduced the share of runs that left damageon the sealed test set from 39.2% to 9.2% (Fisher’s exact test, p = 6×10−8; task-level bootstrap 95%CI for the reduction, 7.5 to 55.0 percentage points) while rolling back 2.7% of harmless runs, and on38 development tasks from 17.4% to 1.6% while asking a person 83% less often than per-action approval. Ablations attribute most of the development-set protection to the human gate; on the test set,most harm was removed by verified rollback. The result has a clear boundary: with a simulated approver who accepts 93% of requests, UNDO still left less damage than approval of every action (12.6%vs. 21.1%; p = 0.04, uncorrected), but not significantly less than no safeguard at all. The runtime, thebenchmark and every run record are publicly available, and we propose per-call reversibility metadatafor the Model Context Protocol