安德森角
代理AI通常不会在代理前退后
在 Google 上的首选来源中添加 Unite.AI
我每天在Arxiv和其他来源拖网的许多材料都相当干燥，即使对于一个书呆子的敏感度来说也是如此；因此，我总是在寻找一份出版物，让我作为AI的使用者、支持者或受害者，在情感上参与其中。
今天，美国新的学术合作提供了黑客激活的那一刻，研究了代理边境AI模型在采取破坏性行动之前烧毁其桥梁的程度 — — 并且比可以输入的“STOP!”要快得多(注意：在剪贴板上保持方便 )。
这从新论文中断章取义，由于盲目遵守ChatGPT的指示，最近发生了在我身上的事情，而且因为我从未想过首先重复整个虚拟信封：
在这个骇人听闻和太过熟悉的例子中，机器人有一个合理的借口，因为检查在脆弱和无法原谅的框架内安装新图书馆可能产生的一切后果并不是惯常的做法。 然而，新文件认为，也许应该这样；而且，作为仍然在达到 CTRL+的人，S经常，即使在自动保存的环境中，也忽略了按键(Thanks,1990年代的数据损失PTSD)，我必须同意。
当然，DataTalks的创始人Alexey Grigorev会赞赏更加谨慎的态度。 俱乐部教育平台，其Claude Code agent去年3月服务器迁移期间删除了生产基础设施和备份，导致网站数据损失两年半。
最近其他在此模具中的代理鲁莽事件包括：Cursor agent在4月删除了汽车租赁软件供应商PocketOS的制作数据库和备份，中断了超过两天的客户预订；以及OpenClaw的电子邮件agent在2月删除了Meta AI研究员收件箱中的信息，尽管一再指示停止。
无论代理与否，边疆LLMs发现很难谨慎行事，以至于补救问题在文献中发展成一个鲜明的线索。
退后一点
新的论文*的作者开发了一个多agent插件，用于代理吊带，能够和嘉宾AI一起运行，并迫使它在必要时创建备份：.
新研究最引人注目的方面之一是前沿模型在采取潜在危险行动之前不支持的程度。 研究人员发现GPT-5.6-泰拉只备份了4.4%的病例的关键数据；GPT-5.6-索尔只备份了5.9%的检测病例；Gemini 3.7-Flash只备份了2.4%的病例。
甚至表现最好的Claude Opus-5也未能在超过三分之一的测试病例中备份关键数据。
该文件指出：
agents平均完成86.1%的任务，Codex中的GPT 5.6-Sol只完成5.9%的任务，Hermes中的DeepSeek V4-Pro只完成2.9%的任务。
“这些调查结果突出表明，目前agents的备份意识仍然有限，需要专门的备份支持。”
作者的解决方案被誉为BackUpper，与agent并肩工作
对于日常操作，如软件升级，它遵循一套简单的规则；对于狡猾的情况，它呼吁用一个较小的AI模型来研究需要保存什么。
在测试中，BackUpper覆盖了每一个关键动作，恢复的数据与原始数据相似92.2%，每个任务额外花费0.014美元 — — 这并非很多，而是前沿LLMs为数十亿客户服务的大量支出；这可能是为什么这种性质的外部服务或者在本地将这种功能纳入到水管中，可能更可能是改善状况的一种方式，而不是希望技术巨头提供本土的固定设备(通过价格上涨或象征性通货膨胀，他们可以合理地预期会把额外费用转移给消费者)。
205个任务基准测试围绕现实世界的案例，人们丢失了他们后来希望保存的数据。 它检验AI agents在作出可能不可逆转的改变之前是否具有保留这些数据的远见。 包括X.com、GitHub和Stack Overflow在内的平台的在线讨论和报告是收集事件的来源。
虽然92%对于完美主义者来说可能是一个令人沮丧的数字，但作者们指出，某些类型的数据的回收存在技术障碍：
`完全恢复的差距主要有两个原因。 一些字段，如邮编ID，一般由写作服务重新生成，往往无法复制。 其他差异来自微小的元数据，如电子邮件读旗
在试验中，在损害发生后恢复了33.8%的与原状态的相似性，而只有14.3%没有恢复。
该文件建议，今后可以通过培训提高备份意识，而后期的BackUpper版本则可以教授跳过低风险动作，并将保护范围扩大到网络和计算机用途agents.
BackUpper 支持 Claude Code, Codex, Hermes, OpenHands, DeepSeek Harness，以及 OpenClaw；作者已经为此提供了代码，以及相关的数据集(虽然必须通过表格寻求允许)；还有一些补充信息，以及一个非常简短且简单的解释性视频在倡议的项目网站上。
方法
在构建Bench时，已经由agents内置备份系统保护的数据被故意排除，这样agents自己对何时做备份的认识就可以测试。 随后在Claude Opus-5和GPT-5.6-Sol的协助下组装了试验场景，然后进行人工检查，以确保这些场景有效，准确反映最初的事件。
遗憾Bench的205个测试涵盖五个领域：终端操作、数据库、网络应用程序、电子邮件和DevOps。 这些事件本身主要源于软件开发和生产力平台(44.4%)；社会或社区讨论(39%)；以及档案和媒体报道(16.6%):
评价的六种前沿模型分别是Claude Opus-5和Claude Sonnet-5,Claude Code;GPT-5.6-Sol和GPT-5.6-Terra,Codex；以及Gemini 3.7-Flash和DeepSeek V4-Pro，赫尔墨斯。
默认思维设置一直被使用，自动备份保护仅限于工作空间快照 — — 允许任何进一步的备份被贷记到agents自己的决定中。
两名AI评委，均由Claude Sonnet-5提供动力，用于评测表现。 任务通过率(PR)是从每个用户要求完成的任务比例计算的。 为了进行备份评估，对每个工作场所外的修改进行了检查，以便事先保存足够的资料，以便进行回收。
使用的备份度量衡是：反映与文件数据损失有关的具体行动的 " 后悔时刻 " 备份率；以及反映agent工作目录之外所有变化的 " 工作外空间 " 备份率。
后备法官的评估也对照人文说明进行了核对，结果达成了95.3%的协议。
结果
为了确定备份意识不佳是AI模型还是运行这些模型的框架导致的，Claude Opus-5,GPT-5.6-Sol和DeepSeek V4-Pro在Claude Code,Codex和Hermes的60个Bench任务上首次被评价。
关键数据得到备份的任务比例在各框架之间差别不大，表明模型本身主要负责。 还利用GPT-5.4,GPT-5.5和GPT-5.6-Sol研究了一般AI能力和备份意识之间的关系。
尽管总体能力连续提高，但在备份意识方面没有发现相应的改善：
还利用GPT-5.4,GPT-5.5和GPT-5.6-Sol研究了一般AI能力和备份意识之间的关系。 尽管总体能力不断提高，但后备意识没有相应改善。
后上层
BackUpper使用四级保护，每级保护的资源成本各不相同：第一级命令用可逆的替代品取代破坏性命令，例如将文件移到垃圾桶中；具有备份命令的二级对操作，例如在升级前记录软件包版本；第3级创建了受影响的工作空间文件的快照；第4级使用GPT-5.6-Luna子剂来识别和保存受更复杂操作影响的数据。
BackUpper启用后，所有6种模式都覆盖了改变状态的行动，而关键行动的平均备份率为15.2%，其他变化的平均备份率为17.4%。
在自动评价员认为成功的备份中，94%也被人类审查员确认为成功。
原始状态得到恢复，平均相似率为92.2%，而Claude Opus-5为33.8%;14.3%没有恢复(见上文图像)。 如前所述，其余差异主要归因于重新生成的识别资料和小元数据，包括电子邮件读旗。
自己来？
当agents被详细指示自己进行备份时，81.4%的关键动作得到了保护，而BackUpper下为100%. 四分之三的故障是由于备份不足，无法进行回收。
快速缓存后，每个任务的备份费用从0.344美元降至0.014美元，延迟率降低31.7%。 需要的代币是7倍，主要是因为日常业务是在没有大赦国际协助的情况下进行的。
在Terminal-Bench 4和DeepSWE的40项额外任务中，实现了GPT-5.6-Sol和Claude Opus-5的100%备份覆盖，但没有降低任务完成率。
所评价的三项选择性备份政策是：" 高影响 "、 " 重大改变 "; " 超越要求 "、 " 用户指示外的改变 "; " 人类工作 "、 " 人类著作 "。 在这方面，根据人类判断，平均达到84.5%的F1分。
BackUpper也被测试了学习可重复使用的备份规则的能力。 在增加了30个终端任务后，基于规则的覆盖范围从14.9%增加到31.2%，减少了对GPT-5.6-Luna亚剂的依赖。
结论
我比本该做的更晚才来做药剂实验，考虑一下我的工作；但药剂自我克制的明显前期状态让我害怕，直到几个星期前，我终于决定让Codex在Windows VM松绑。
我非常仔细地观察我的指示，了解Astra放弃的意向，当数据丢失或被破坏的代码无法返回时
这些是极早的代理人工智能；不仅代理备用制度尚未正式确定，甚至尚未制定。
* 在你后悔之前标题退后：在编码 Agents中测量备份意识和自动备份。
+ 作者的强调，不是我的；任何超文本链接都是我从作者的内在引文中得出的。
首刊于2026年10月22日星期四
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anderson's Angle
Agentic AI Doesn’t Usually Back Up Before Acting
Add Unite.AI to your preferred sources on Google
A lot of the material that I trawl at Arxiv and other sources every day is rather dry, even for a nerd’s sensibilities; therefore I’m always looking for a publication that engages me emotionally, as a user, proponent, or victim of AI.
Today that moment of hackle-activation was supplied by a new academic collaboration from the US, examining the extent to which agentic frontier AI models burn their bridges before taking damaging action – and faster than you can type ‘STOP!’ (hint: keep it handy in the clipboard).
This, taken out of context from the new paper, has happened to me lately, thanks to blind adherence to instructions from ChatGPT, and since it never occurred to me to duplicate the entire virtual envelope first:
In this horrifying and all-too-familiar example, the robot has a reasonable excuse, because it is not habitual to inspect all possible consequences of installing a new library in a fragile and unforgiving framework. However, the new paper argues that maybe it should be; and, as someone who still hits CTRL+S frequently, even in autosave environments scoped to ignore that keystroke (thanks, 1990s-era data-loss PTSD), I must concur.
Certainly, a more circumspect and cautious attitude would have been appreciated by Alexey Grigorev, the founder of the DataTalks.Club education platform, whose Claude Code agent deleted production infrastructure and backups during server migration last March, resulting in the loss of two and a half years of website data.
Other recent incidents of agentic recklessness in this mold include a Cursor agent deleting car-rental software provider PocketOS’s production database and backups in April, disrupting customer reservations for more than two days; and an OpenClaw email agent deleting messages from a Meta AI researcher’s inbox in February, despite repeated instructions to stop.
Agentic or not, frontier LLMs find it very difficult to act with circumspection and caution, to the point where remedying the issue has developed into a distinct thread in the literature.
Back Up a Bit
Well, the authors of the new paper* have developed a multi-agent plugin for agentic harnesses, capable of operating alongside the guest AI, and forcing it to create backups when necessary:
One of the most striking aspects of the new study is the extent to which frontier models do not back up before taking potentially hazardous action. The researchers found that GPT-5.6-Terra backed up critical data in only 4.4% of cases; GPT-5.6-Sol in just 5.9% of cases tested; and Gemini 3.7-Flash in as few as 2.4% of cases.
Even the best performer, Claude Opus-5, failed to back up critical data in more than a third of cases tested.
The paper states†:
‘Across six frontier models, agents complete 86.1% of tasks on average but back up state before regret moments in only 15.2%. GPT 5.6-Sol in Codex does so in just 5.9% of tasks, and DeepSeek V4-Pro in Hermes in only 2.9%.
‘These findings highlight that backup awareness remains limited in current agents and that dedicated backup support is needed.’
The authors’ solution, dubbed BackUpper, works alongside the agent, as a shadow operation in the harness, checking what it’s about to do, and making a backup first if there’s a risk of losing something useful.
For everyday operations, such as upgrading software, it follows a set of simple rules; for trickier situations, it calls in a smaller AI model to work out what needs saving.
In tests, BackUpper covered every critical action, with the restored data 92.2% similar to the original, at an extra cost of $0.014 per task – not much in this context, but a significant expenditure for frontier LLMs serving billions of customers; which may be why an external service of this nature, or the native inclusion of such functionality in harnesses, may be a more likely way to improve the situation, rather than hoping for a native fix from the tech giants (who could reasonably be expected to pass on the extra costs to their consumers, either through price rises or token inflation).
The framework is informed by RegretBench, a 205-task benchmark built around real-world cases where people lost data that they later wished they’d saved. It tests whether AI agents have the foresight to preserve that data before making potentially irreversible changes. The incidents comprising the collection were sourced from online discussions and reports on platforms including X.com, GitHub, and Stack Overflow.
Though 92% may be a discouraging figure for the perfectionist, the authors note that there are technical obstacles to recovery of certain types of data:
‘The gap to perfect restoration mainly arises for two reasons. Some fields, such as post IDs, are typically regenerated by services on write and often cannot be reproduced. Other differences come from minor metadata, such as email read flags, which regret moments rarely involve.’
In tests, 33.8% similarity to the original state was recovered after the damage had already occurred, compared with just 14.3% without restoration.
The paper suggests that for the future, backup awareness could be improved through training, while later versions of BackUpper could be taught to skip low-risk actions and extend protection to web and computer-use agents.
BackUpper supports Claude Code, Codex, Hermes, OpenHands, DeepSeek Harness, and OpenClaw; and the authors have made the code for it available, along with the related dataset (though permission for this must be sought via a form); and there is a little additional information, as well as a very short and simple explanatory video at the initiative’s project site.
Method
In constructing RegretBench, data already protected by the agents’ built-in backup systems was deliberately excluded, so that the agents’ own awareness of when to make a backup could be tested. The test scenarios were then assembled with assistance from Claude Opus-5 and GPT-5.6-Sol, and then manually checked to ensure that they worked, and that they accurately reflected the original incidents.
RegretBench’s 205 tests cover five areas: terminal operations; databases; web applications; email; and DevOps. The incidents themselves originate mainly from software development and productivity platforms (44.4%); social or community discussions (39%); and archives and media reports (16.6%):
The six frontier models evaluated were Claude Opus-5 and Claude Sonnet-5, in Claude Code; GPT-5.6-Sol and GPT-5.6-Terra, in Codex; and Gemini 3.7-Flash and DeepSeek V4-Pro, in Hermes.
Default thinking settings were used throughout, and automatic backup protection restricted to workspace snapshots – allowing any further backups to be credited to the agents’ own decisions.
Two AI judges, both powered by Claude Sonnet-5, were used to assess performance. Task Pass Rate (PR) was calculated from the proportion of tasks in which every user request was fulfilled. For backup assessment, each out-of-workspace (OOW) modification was checked for sufficient information having been preserved beforehand, to permit recovery.
Backup metrics used were Regret Moment Backup Rate (RMBR), reflecting the specific actions associated with documented data loss; and Out-of-Workspace Backup Rate (OWBR), reflecting all changes made beyond the agent’s working directory.
The backup judge’s assessments were also checked against human annotations, leading to 95.3% agreement.
Results
To establish whether poor backup awareness was caused by the AI models or the frameworks running them, Claude Opus-5, GPT-5.6-Sol and DeepSeek V4-Pro were each first evaluated on 60 RegretBench tasks in Claude Code, Codex and Hermes.
The proportion of tasks in which critical data was backed up varied little between frameworks, suggesting that the models themselves were chiefly responsible. The relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol.
Despite successive improvements in general capability, no corresponding improvement in backup awareness was found:
The relationship between general AI capability and backup awareness was also examined using GPT-5.4, GPT-5.5 and GPT-5.6-Sol. Despite successive improvements in general capability, no corresponding improvement in backup awareness emerged.
BackUpper
BackUpper uses four tiers of protection, each with varying resource costs: Tier 1 replaces destructive commands with reversible alternatives, such as moving files to the trash; Tier 2 pairs operations with backup commands, such as recording package versions before an upgrade; Tier 3 creates snapshots of affected workspace files; and Tier 4 uses a GPT-5.6-Luna subagent to identify and preserve data affected by more complex operations.
With BackUpper enabled, every state-changing action was covered across all six models, compared with average backup rates of 15.2% for critical actions and 17.4% for other changes without it:
Of the backups judged successful by the automated evaluator, 94% were also confirmed as successful by human reviewers.
The original state was recovered with 92.2% average similarity, compared with 33.8% under Claude Opus-5; and 14.3% without recovery (see image above). The remaining discrepancies were largely attributed to regenerated identifiers and minor metadata, including email read flags, as noted earlier.
Do-It-Yourself..?
When agents were given detailed instructions to make their own backups, 81.4% of critical actions were protected, compared with 100% under BackUpper. Three-quarters of the failures were attributed to backups containing insufficient information for recovery.
With prompt caching, backup costs were reduced from $0.344 to $0.014 per task, and latency by 31.7%. Seven times fewer tokens were required, largely because routine operations were handled without AI assistance.
On 40 additional tasks from Terminal-Bench 4 and DeepSWE, 100% backup coverage was achieved with GPT-5.6-Sol and Claude Opus-5, without reducing task completion rates.
The three selective backup policies evaluated were High-Impact, for significant changes; Beyond-Request, for changes outside the user’s instructions; and Human-Work, for human-authored material. Here, an average F1 score of 84.5% was achieved against human judgments.
BackUpper was also tested for its ability to learn reusable backup rules. Following 30 additional terminal tasks, rule-based coverage increased from 14.9% to 31.2%, reducing dependence on the GPT-5.6-Luna subagent.
Conclusion
I have come to agentic experimentation later than I should, considering what I do for a living; but the manifestly pre-alpha state of agentic self-restraint scared me off until a few weeks ago, when I finally decide to let Codex loose in a Windows VM.
Even within the context of a VM, I scope my instructions very carefully, aware of Astra’s disposition to rush forward with abandon, and just offer apologies when there’s no way back from data loss or ruined code; and part of the Python framework that I am developing there is a one-click incremental ‘save .7z to network share’ function, which compresses and backups up the entire framework, and which I call frequently.
These are very, very early days in agentic AI; without a tedious and assiduous attention to detail, it’s a case of ‘use it and lose it’. Not only have agentic backup regimes not been formalized yet, they have not even been formulated.
* Titled Back Up Before You Regret: Measuring Backup Awareness and Automating Backup in Coding Agents.
† Authors’ emphases, not mine; and any hyperlinks are derived by me from the authors’ inline citations.
First published Thursday, October 22, 2026
Auto-fetched and translated by AI Atlas. All rights belong to the original author.