Detection Isn't Enough: Enterprises Need a Way to Undo What AI Agents Do

Most enterprise conversations about AI agent risk are about seeing problems: monitoring, tracing, alerts. Far fewer are about what happens next, when an agent has already changed a database, overwritten a configuration or corrupted its own memory. This week Cohesity launched a product built around that second question, and whatever buyers think of the product, the question deserves a place in every agent rollout. Our view: before an agent gets write access to anything that matters, the team that owns it should be able to show how it would undo the agent's work.

What did Cohesity launch?

Cohesity announced Agent Resilience at its Catalyst event on September 21, according to the release published by StorageNewsletter. It discovers the infrastructure behind an agent, including its memory stores, configuration and connected databases, and offers point-in-time recovery to return the agent and the systems it touched to a known-good state. At launch it supports Amazon Bedrock AgentCore and Bedrock Agents, with Microsoft and Google agent platforms on the roadmap. It is available to select customers now, with general availability targeted for the end of 2026.

Cohesity's chief product officer, Vasu Murthy, framed the pitch simply. Detection can show that an agent went off course, he said, but "it cannot undo the changes."

The company also cited its own annual resilience survey, in which 56% of organizations said they were not well prepared to detect or contain unintended actions by AI agents and automated workflows, and 58% were not very confident they could verify the integrity of AI models and related data after an attack. Those are vendor figures and should be read that way, but they match what we hear from practitioners.

Why is recovery the missing piece in agent governance?

Agents fail in ways that are hard to catch in the moment. In a AI Connect webinar on AI agent observability, Sam Mittal, VP of AI Solutions at Snowflake, warned that "production AI that works on Monday can silently degrade by Thursday." By the time a drift alert fires, an agent may have written thousands of records.

Human review does not close the gap either. "Human in the loop doesn't work when you're overwhelming the human with decisions," Cal Al-Dhubaib of Rubrik said at The AI Enterprise Conference 2026, in a session on designing for when agents overreach. If approvals become reflexive, a reliable way back to a known-good state is what limits the damage.

This is not a new idea in IT. Databases have transaction logs, infrastructure teams keep snapshots and change management requires a rollback plan before anything ships. Agents get write access to the same systems, often with broad service accounts, and are frequently deployed without any equivalent. An agent's memory and configuration are now production state too, and they rarely sit in anyone's backup plan.

What are the limits of rolling back an AI agent?

The case against leaning on recovery tools is fair and worth taking seriously. First, prevention matters more. Least-privilege access, scoped identities and policy checks outside the agent's reasoning stop many problems before they need undoing, a point practitioners made in a AI Connect panel on where humans belong in agentic AI.

Second, snapshots cannot recall an email, reverse a wire transfer or unpublish data that has already left the building. Restoring a database to its state at 9 a.m. can also erase legitimate work done since then. Recovery reduces the cost of internal mistakes. It does not make external actions reversible.

Third, buyers have reason to be wary of another point product. Cohesity's launch covers one cloud's agent platforms today, and the major platforms may build similar features in. Teams should not buy a recovery layer before they have an inventory of their agents.

None of that argues against the principle. It argues for applying it with judgment: the more an agent can change, and the harder those changes are to see, the more a tested recovery path matters.

What should enterprise AI teams do now?

Add one question to every agent's production review: if this agent misbehaves for a day before anyone notices, how do we restore what it changed? The answer might be a vendor product, native database features, versioned configuration or an approval gate on irreversible actions. What matters is that someone owns the answer and has tested it.

Then sort agent actions into those that can be undone and those that cannot, and put the strongest controls on the second group. Teams already building trust gates that check data before agents act are halfway there. Recovery is the other half: the plan for when the gate is not enough.

Frequently asked questions

What is Cohesity Agent Resilience?

A Cohesity Data Cloud capability, announced September 21, that maps an agent's memory, configuration and connected systems and restores them to a known-good point in time.

Can you roll back an AI agent's actions?

Changes inside systems you control, such as databases and configurations, can often be restored. External actions such as sent emails or payments generally cannot.

What should an agent production review include?

Scoped permissions, logging, a list of irreversible actions with approval gates, and a tested plan to restore anything the agent changes.

Opinion pieces reflect the views of The AI Enterprise Magazine Team.

Filed under: Agentic AI, AI Governance & Trust, Observability & Data Quality