The report
A container restart should not silently turn a paused, approval-seeking agent into an agent that has forgotten what it was waiting for. Yet a study of 433 open-source agent deployments found mismatches between framework expectations of durable conversations and disposable-container behavior. Among 265 systems whose state needed to survive process restart, 99, or 37.4%, failed the relevant state contract. Restart result.
The authors also report relevant losses in 41.5% of the assessed container-replacement configurations and reproduced 14 of 16 predicted violations through fault injection. These figures do not describe all containerized apps. They concern the subset with applicable state requirements and the deployment configurations examined in the paper. Replacement result.
Persistence is more than keeping the chat transcript
An agent may have a pending tool result, an unacknowledged human approval, a retry marker and an external action that already completed. Saving the conversational summary alone cannot determine whether repeating a transaction after restart is safe. The study's developer-repair review found that 78% of observed fixes changed application code, while roughly two thirds fully restored the relevant operational contract. Repair evidence.
The practical acceptance test is lifecycle-based: start a multi-step task, persist the exact authorization and side-effect identifiers, then restart and replace its container at each transition. A successful recovery should neither lose the required approval nor repeat an already committed effect. The paper documents real configuration weaknesses and controlled reproductions, but it does not establish that a malicious actor exploited them. Research source.