UndoBench: Separating Task Competence from Recovery Capability in Tool-Using AI Agents

UndoBench. Separating Task Competence from Recovery Capability in Tool-Using AI Agents. By Dolly Sah and three others, working independently. Published on the fourth of October. Its code repository is worked out: about one hundred and twenty source files, with a readme and a licence.

Tool-using AI agents are increasingly deployed across enterprise software, and the benchmarks widely used to judge them mostly check one thing: whether the task was completed under nominal conditions. That folds two different abilities into a single score. One is baseline planning competence. The other is what the agent does when an operation faults partway through and it has to recover. A benchmark that only measures completion cannot tell those apart.

UndoBench is built to separate them. It spans thirty-six base workflows and thirty-six fault scenarios across eight enterprise domains. Alongside nominal competence it reports a conditional recovery success rate, or CRSR, and it tracks whether a recovery attempt produces duplicate external effects, which the results show naive retry doing often.

The decoupling comes from counterfactual paired trials run under identical seeds, so the effect of a fault can be isolated from the task itself. Two kinds of oracle check each outcome: a wire-level history of effects, and the state of the environment. The main study, which the authors call the frozen lost-acknowledgment study, uses twelve held-out test workflows, two open-weight models, two frameworks, and three recovery paradigms. That comes to five thousand seven hundred and sixty executions, forming two thousand eight hundred and eighty paired trials.

Nominal competence reached eighty-three point five four percent. The conditional recovery success rate fell to forty-six point seven two percent. Naive retry produced duplicate external effects in fifty-three point three three percent of trials. Extensions to commercial API models reproduced the same separation between competence and recovery.

Across complementary execution boundaries, recovery proves to be phase-dependent. Before any mutation, the methods perform similarly, without duplicate effects among capable trials. During a partial mutation, naive retry, per-call idempotency and zero-privilege journaling all collapse on the composite workflows evaluated. After a commit but before acknowledgment, verification and server-side idempotency substantially improve safety.

The authors conclude that evaluating nominal completion alone masks critical recovery vulnerabilities, and that those vulnerabilities depend on phase. Put as a question an operator might ask: will this agent make things worse when it retries? A single success rate cannot answer that, and the answer differs depending on whether the fault landed before, during, or after the change was made.