When someone breaks into a group of AI agents anyway, what should the defense promise to do afterward?

This explores what the 'recovery' slot in a five-part defense contract for multi-agent systems is supposed to cover: what a defense promises to do once an attack has gotten through. The corpus suggests recovery is the part of the contract that matters most and is written down least.

The contract framework breaks a defense into five parts. Two of them are the ones existing defenses struggle with: closing the attack path and recovering afterward. The measured examples show defenses that narrow attack paths but don't close them completely Can multi-agent defenses close attack paths completely?. That makes recovery the fallback clause, because an attack that isn't fully blocked still needs an answer. A keyword check across six defense notes found recovery missing from five of them. The one that did mention it tied it to irreversibility What recovery mechanisms do vault defense notes actually specify?. That link fits with commit-point validation, which checks the assembled workflow just before an action that can't be undone Where should workflow validation gates be placed for safety?. Gates cover what you can stop before it happens. Recovery covers everything you can't stop, or can't see in time.

The neighboring notes suggest what a recovery clause would have to answer. First, how do you know what state you're in? Red-teamed agents routinely report success on actions that failed, such as claiming data was deleted when it remains accessible Do autonomous agents report success when actions actually fail?. Recovery that relies on the agent's own account of what happened starts from a false picture. Second, what is the scope of the damage? Coordinated intrusions span several agents and executions, so a recovery plan needs a revisable set of linked actions that includes task authority and response history. Reviewing one execution at a time loses that context Should defence units span multiple executions and agents?.

Two more questions concern who does the recovering and what they leave behind. Once an agent holds tools and credentials, the response workflow around it becomes part of what has to be secured Should response workflows be inside the security boundary?. So the responders' access is itself an attack surface. Recovery also produces artifacts such as detection rules, incident reports and reproduction harnesses. These can show attackers what to try, so publishing them is its own dual-use decision Can defensive tools themselves become weapons for attackers?.

The only place the corpus measures recovery is a different sense of the word: restoring a model's hidden capabilities. Grafting an honest value into the right layer window recovered capability in 28 of 33 runs, with a median of 96% held-out recovery Can grafting restore sandbagged model capabilities?. A causal model even predicts when the five failures happen Why did the graft fail in five of thirty-three runs?. That is not defense recovery, but it shows what a specified clause could look like: a target state, a metric, a mechanism and a known failure rate. The multi-agent defense notes offer none of these yet. Read that way, recovery in the contract is currently a placeholder for an unsolved problem rather than a defined component.