The agent expects memory, pending runs and approval state to persist while the deployment runtime may restart or replace its container. If the state is process-local or a persistence adapter is not wired, a new process cannot recover the same work context. Among 265 examined systems requiring process-independent state, 99 (37.4%) lost relevant state under…
Inspect the ClaimsCase · DiggingBeagle record
Agent container restarts could silently erase conversation state and pending approvals
A study audits operational state guarantees in deployed agent project configurations and reproduces failures through fault injection.
Scope
The corpus includes 433 agent systems selected by the researchers. These are configuration and test failures, not evidence that an adversary deliberately changed approvals or that all systems are deployed in production.
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- BY AI
Basis and provenance
A 433-project configuration audit identifies systems requiring durable state; the 37.4% restart and 41.5% replacement failures use applicable denominators, and fault injection reproduced 14 of 16 flagged violations. These are operational reproductions, not malicious production compromises. Impact is left ungraded because a calibrated 0-to-4 impact basis for actual affected targets is unavailable from these Claims.
Assessed Oct 28, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP22-016-A · CLM-CP22-016-B · CLM-ENRICH-20261028-001 · Built to Remember, Shipped to Forget: Containerized Agent Deployments
At a glance
Whether repair mechanisms can restore authorization intent correctly after partial external side effects is not established.
Limits and uncertaintyFull account
The agent expects memory, pending runs and approval state to persist while the deployment runtime may restart or replace its container. If the state is process-local or a persistence adapter is not wired, a new process cannot recover the same work context.
Among 265 examined systems requiring process-independent state, 99 (37.4%) lost relevant state under restart conditions. The authors report 41.5% relevant losses under container replacement and reproduced 14 of 16 predicted violations with fault tests. Primary evidence.
The corpus includes 433 agent systems selected by the researchers. These are configuration and test failures, not evidence that an adversary deliberately changed approvals or that all systems are deployed in production.
Persist grants and execution checkpoints outside the process; replay under idempotency keys and test kills during every side-effect boundary.
Claims & evidence
CLM-CP22-016-AAmong 265 examined systems requiring process-independent state, 99 (37.4%) lost relevant state under restart conditions.supported
Basis: reported finding
- supportsBuilt to Remember, Shipped to Forget: Containerized Agent Deploymentsprimary disclosure
Section IV, OC1 durability table
CLM-CP22-016-BThe authors report 41.5% relevant losses under container replacement and reproduced 14 of 16 predicted violations with fault tests.supported
Basis: reported finding
- supportsBuilt to Remember, Shipped to Forget: Containerized Agent Deploymentsprimary disclosure
Abstract; Section IV and V fault-injection results
CLM-ENRICH-20261028-001The study reports that 78% of observed developer repairs modified application code, while only about two thirds fully restored the relevant operational contract.supported
Basis: reported finding
- supportsBuilt to Remember, Shipped to Forget: Containerized Agent Deploymentsprimary disclosure
Section VI developer repair taxonomy and Abstract
Controls and mitigations
- Persist grants and execution checkpoints outside the process; replay under idempotency keys and test kills during every side-effect boundary.
Unknowns and contradictions
- Whether repair mechanisms can restore authorization intent correctly after partial external side effects is not established.
Sources and citation
Material revision history
- Oct 28, 2026 · Canonical change recorded · new in release · revision 199