Cohesity backs up AI agent memory so admins can roll a misbehaving agent back

An agent with privileged credentials has been querying databases and acting on the answers, and nobody has been reviewing each step ^[2]. A governance tool flags behavior that looks wrong. Cohesity's case is that the flag is where those tools stop: they can spot unexpected behavior but cannot restore the data or systems an agent has changed, corrupted or deleted ^[3]. "Detection can tell you an AI agent went off course," said Vasu Murthy, Cohesity's chief product officer ^[4]. "It cannot undo the changes." ^[5]

Four capabilities came out of Catalyst, and one of them is generally available now ^[19]. Agent Resilience is with select customers, with general availability expected by the end of the year ^[14]. Maestro, which will let customers reach Cohesity's protection and recovery functions from Anthropic's Claude, OpenAI's ChatGPT and Google's Gemini, is expected later this year ^[16]. Autonomous Cyber Resilience is a plan: an administrator would give Cohesity Copilot a goal such as every application the business needs during a cyberattack meeting set recovery time and recovery point objectives, and Data Cloud would recommend protection policies, threat scans and recovery rehearsals, with nothing running without approval ^[15]. The one thing a customer can switch on now is automatic protection of newly discovered sensitive data, for anyone running Data Cloud Enterprise Edition with Cohesity DSPM ^[17].

Memory and configuration are what Agent Resilience covers at launch, protected by the immutable backups and clean-room recovery Cohesity already runs for on-premises, cloud and software-as-a-service workloads ^[9]. The restore is narrow: an administrator picks a recovery point from before the suspicious behavior started, and only the affected memory or settings come back ^[10]. A second function finds the databases, file systems and vector stores the agent works with and protects those as well ^[11]. Putting an agent's memory back to Tuesday does not unwrite what it did to a shared production database on Wednesday, and the launch description covers scoping for memory and settings without saying whether a restore of one of those data stores can be limited to the agent's own writes ^[20].

Each agent also gets a topology map listing the systems it connects to and the data it can reach. Cohesity says the map is meant to expose protection gaps and recovery dependencies before anything breaks ^[12]. I would expect the first useful output for most buyers to be the list itself, since the company also says most organizations are not protecting agent state today ^[6].

For now this works only on agents built on Amazon Web Services' Bedrock, covering both Bedrock AgentCore and Bedrock Agents, with Microsoft and Google platforms on the roadmap ^[13]. Teams standardized elsewhere are waiting either way.

A rollout plan needs three columns per production agent, and two of them cost nothing to fill: the newest recovery point for the agent's memory and configuration, every system it can write to, and who authorizes a rollback and how long that takes. Cohesity says a prompt injection can leave an agent that looks normal on the surface while acting on information it should never have trusted ^[7]. When the alert lands days after the injection, the recovery point an administrator needs is older than the behavior that prompted the search, and an agent with no clean recovery point may have to be wiped and rebuilt ^[8].