When an AI agent crashes halfway through processing a customer refund, a replacement agent that spins up to finish the job faces a dangerous choice: it might issue a second refund to the same customer, according to a technical report published by The New Stack. The report examines what happens when autonomous agents fail during critical business operations, finding that the core problem isn't the crash itself but what comes after. Unlike conventional automated workers that resume a predetermined workflow from the last checkpoint, an agent reasons independently—and a replacement agent, encountering the same customer request with no recorded outcome, might devise a different plan, select different parameters, or decide to issue a fresh refund instead of continuing the one already approved.
The report describes a scenario where an agent receives approval to process a partial refund, sends the request to a payment API, and then crashes. The payment service may have completed the refund, or the request may never have gone through—the replacement agent can't tell. If the original refund succeeded, a second attempt refunds the customer twice. Because the charge retains enough remaining balance to cover another partial refund, nothing prevents the duplicate. The report explains that the operation must outlive the agent: "An agent's process, its in-memory variables, its transient reasoning context: all disposable. The business operation is not." To prevent this, the application must commit a durable operation record to a transactional store before dispatching the refund. That record includes the approved amount, the applicable authorization, the idempotency key sent to the payment provider, the application's operation identifier in the provider's metadata, and a status that moves from created to dispatched as the request leaves, and to confirmed or failed only when a provider response arrives.
The report states that the durable record isn't just context for the replacement—it's enforced at the tool boundary. "The agent can propose a next step, but only authorized operations with their original parameters and identity reach the provider," the authors write. The model can't redefine what was approved. According to the report, durable execution frameworks like LangGraph and Temporal record execution progress and resume after a failure, but resuming doesn't resolve the uncertainty. If the refund completed while the step was still pending, the framework can restart the agent, but it can't tell the replacement whether the payment provider committed the original request. The report emphasizes that "a stored approval is historical evidence, not current authority to act." Even after establishing the external outcome, the replacement must verify that conditions haven't changed—the refundable balance may have shifted, a human representative might have processed a separate refund through a different interface, or someone may have revoked the original authorization.
The report argues that the real engineering challenge is whether a new agent can establish the work's current objective, outstanding obligations, and uncertain effects, then continue safely without treating the predecessor's recollections as authority. The replacement must follow the recovery protocol the application defines, not its own judgment about the customer's situation. If the provider confirms the refund is complete, the replacement records the outcome and moves on. If the provider shows the refund is still pending or in progress, the replacement waits—retrying would risk a duplicate. If the refund definitively failed with no external effect, the replacement revalidates preconditions before a new authorized attempt. If the outcome remains unclear, it escalates rather than guessing, because a missing provider record doesn't prove the refund was never processed. The report's bottom line: the agent is disposable, but the work isn't. Organizations deploying autonomous agents in transactional environments will need to rethink not just how systems recover from failure, but who—or what—holds the authority to decide what happens next when memory is lost.