--- title: ACRFence: Preventing Semantic Rollback Attacks in Agent... description: Semantic rollback attacks exploit the gap between rolled-back AI agent state and non-rolled-back external state. When an agent framework restores from a... canonical: https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore | daily.dev og:description: Semantic rollback attacks exploit the gap between rolled-back AI agent state and non-rolled-back external state. When an agent framework restores from a... og:url: https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka og:image: https://api.daily.dev/og/posts/C1UHs2mka.png og:image:alt: ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore **[eunomia eBPF Blog](https://daily.dev/sources/eunomia)** · 11 min read · 0 upvotes · 0 comments ## Summary Semantic rollback attacks exploit the gap between rolled-back AI agent state and non-rolled-back external state. When an agent framework restores from a checkpoint after a crash, the LLM may regenerate tool calls with different identifiers (UUIDs, nonces, timestamps), causing external services to treat them as new requests. Two attack classes are identified: Action Replay (duplicate irreversible actions like payments) and Authority Resurrection (reusing consumed one-time tokens). Experiments with Claude Code CLI and Qwen3-32B confirmed 10/10 duplicate commits in checkpoint/restore trials. The proposed mitigation, ACRFence, acts as an MCP proxy that records irreversible effects and enforces replay-or-fork semantics: semantically equivalent post-restore calls return cached results, semantically divergent calls require explicit forking, and consumed credentials are blocked. The problem affects LangGraph, CrewAI, Google ADK, AutoGen, and other frameworks. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is a semantic rollback attack in AI agent frameworks? A semantic rollback attack exploits the gap between rolled-back local agent state and non-rolled-back external state. After a checkpoint restore, an LLM regenerates tool calls with different identifiers (new UUIDs, nonces, timestamps) rather than byte-identical retries. External services see these as new valid requests and re-execute irreversible actions like payments or data deletions, even though the agent's local view shows only one execution. _Teams shipping AI agents with external tool calls track this class of vulnerability on daily.dev._ ### Why doesn't standard idempotency key deduplication protect against AI agent checkpoint restore attacks? Standard idempotency deduplication requires the caller to retry with the same key or critical parameters. After a checkpoint restore, an LLM agent rethinks its next action from context rather than replaying a recorded request — even at temperature 0, byte-identical tool calls are not guaranteed. The agent may generate a fresh UUID or reference number, so the server sees a new valid request and cannot recognize it as a retry of the same intent. _Developers choosing between durable execution and LLM-based agent frameworks weigh exactly this trade-off on daily.dev._ ### How does ACRFence prevent duplicate tool calls after an AI agent checkpoint restore? ACRFence acts as an MCP proxy between the agent and external services, logging irreversible tool calls including tool name, arguments, return value, and consumed credentials. On restore, it compares new calls against the log using an analyzer LLM: semantically equivalent calls (same recipient and amount, different UUID) return the cached result without re-execution; semantically divergent calls (different target) require an explicit fork; consumed credentials are blocked before reaching the target service. _Keeping up with AI agent security patterns like ACRFence is easier when the relevant research surfaces together on daily.dev._ ## Similar posts on daily.dev - [Why Agent Crashes Are Nothing Like Database Crashes](https://daily.dev/posts/why-agent-crashes-are-nothing-like-database-crashes-ksqsnije3) · Daily Dose of Data Science \| Avi Chawla \| Substack · 2 upvotes · 0 comments - [The Guardrail Blocked the Request. The Agent Had Already Called the Tool.](https://daily.dev/posts/the-guardrail-blocked-the-request-the-agent-had-already-called-the-tool--dqz2tqyz0) · Medium · 1 upvotes · 0 comments - [AI agents need continuity, not just context](https://daily.dev/posts/ai-agents-need-continuity-not-just-context-ytamjkqsn) · Pulumi · 3 upvotes · 1 comments - [Do Not Let Your AI Go Rogue, Guard Against Agentic Misalignment](https://daily.dev/posts/do-not-let-your-ai-go-rogue-guard-against-agentic-misalignment-pyph3afhj) · Auth0 · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#llm](https://daily.dev/tags/llm), [#ai-agents](https://daily.dev/tags/ai-agents), [#mcp](https://daily.dev/tags/mcp) [View this post on daily.dev](https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore","url":"https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka"},"datePublished":"2026-08-11T08:52:23.306Z","dateModified":"2026-08-11T09:07:53.935Z","description":"Semantic rollback attacks exploit the gap between rolled-back AI agent state and non-rolled-back external state. When an agent framework restores from a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b59e04eefe0ea85df0b7e50151b0b12e?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"eunomia eBPF Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"eunomia eBPF Blog","logo":"https://media.daily.dev/image/upload/s--z-nTl7TK--/f_auto,q_auto/v1786438304/logos/eunomia?_a=BAMAMicg0","url":"https://daily.dev/sources/eunomia"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,llm,ai-agents,mcp","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"eunomia eBPF Blog","item":"https://daily.dev/sources/eunomia"},{"@type":"ListItem","position":3,"name":"ACRFence: Preventing Semantic Rollback Attacks in Agent Checkpoint-Restore"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/acrfence-preventing-semantic-rollback-attacks-in-agent-checkpoint-restore-c1uhs2mka#faq","mainEntity":[{"@type":"Question","name":"What is a semantic rollback attack in AI agent frameworks?","acceptedAnswer":{"@type":"Answer","text":"A semantic rollback attack exploits the gap between rolled-back local agent state and non-rolled-back external state. After a checkpoint restore, an LLM regenerates tool calls with different identifiers (new UUIDs, nonces, timestamps) rather than byte-identical retries. External services see these as new valid requests and re-execute irreversible actions like payments or data deletions, even though the agent's local view shows only one execution. Teams shipping AI agents with external tool calls track this class of vulnerability on daily.dev."}},{"@type":"Question","name":"Why doesn't standard idempotency key deduplication protect against AI agent checkpoint restore attacks?","acceptedAnswer":{"@type":"Answer","text":"Standard idempotency deduplication requires the caller to retry with the same key or critical parameters. After a checkpoint restore, an LLM agent rethinks its next action from context rather than replaying a recorded request — even at temperature 0, byte-identical tool calls are not guaranteed. The agent may generate a fresh UUID or reference number, so the server sees a new valid request and cannot recognize it as a retry of the same intent. Developers choosing between durable execution and LLM-based agent frameworks weigh exactly this trade-off on daily.dev."}},{"@type":"Question","name":"How does ACRFence prevent duplicate tool calls after an AI agent checkpoint restore?","acceptedAnswer":{"@type":"Answer","text":"ACRFence acts as an MCP proxy between the agent and external services, logging irreversible tool calls including tool name, arguments, return value, and consumed credentials. On restore, it compares new calls against the log using an analyzer LLM: semantically equivalent calls (same recipient and amount, different UUID) return the cached result without re-execution; semantically divergent calls (different target) require an explicit fork; consumed credentials are blocked before reaching the target service. Keeping up with AI agent security patterns like ACRFence is easier when the relevant research surfaces together on daily.dev."}}]} ```