Researchers built a stress test for AI agents that rewrite their own prompts and tools - and most of the rewrites cannot be undone.
The paper, called EvoUndo, ran 600 one-shot self-evolution tasks in which an LLM agent modified its own prompts, tools, or middleware. Of those, 197 mutations improved the agent's capability but failed a recoverability check, meaning the agent could not cleanly reverse them once the system had moved to a different state. Standard repair methods fixed none of the 197. A deterministic oracle then split those failures into two groups: 48 were fixable using the agent's original recovery language, and 143 needed an expanded recovery vocabulary to be fixable at all - together covering 191 of the 197 cases, with 6 unrecoverable by any method tested.
What closes each gap is the more interesting finding. Giving the agent exact state-address tracking - knowing precisely which resource changed and where - lifted practical recovery in the 48-case group from 0 to 38, a 79 percent success rate. Swapping in the richer recovery language fixed 142 of the 143 harder cases. But stacking both fixes together on one model backbone, gpt-oss-120b, actually dropped that number to 133, a regression that disappeared when the same setup ran on a different model, Qwen3.8-27B.
Letting an agent patch itself has never been the hard part. Making sure it can also cleanly un-patch itself, on demand, in a system that has since moved on - that is the part nobody had actually tested until now.