# Crab: A Semantics-Aware Checkpoint/Restore Runtime for Agent Sandboxes

arXiv: https://arxiv.org/abs/2604.28138 · HTML: https://mlsanity.com/paper/2604.28138/

## Key facts

- Cited by 13 papers in the map (data through 14 Oct 2026).
- Placed in Software engineering coding agents, one of 16 directions in LLM agents and tool use.
- Builds on 13 of its 49 references that are in the map.
- First posted on arXiv 30 Apr 2026.

## Placed in

- LLM agents and tool use / [Software engineering coding agents](https://mlsanity.com/agents/software-engineering-coding-agents/)

## Builds on (most cited first, 13 of 13)

- [SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineering](https://mlsanity.com/paper/2405.15793/) (2024)
- [Terminal-Bench: Benchmarking Agents on Hard, Realistic Tasks in Command Line Interfaces](https://mlsanity.com/paper/2601.11868/) (2026)
- [SpotServe: Serving Generative Large Language Models on Preemptible Instances](https://mlsanity.com/paper/2311.15566/) (2023)
- [Tree Search for LLM Agent Reinforcement Learning](https://mlsanity.com/paper/2509.21240/) (2025)
- [Let It Flow: Agentic Crafting on Rock and Roll, Building the ROME Model within an Open Agentic Learning Ecosystem](https://mlsanity.com/paper/2512.24873/) (2025)
- [Speculative Actions: A Lossless Framework for Faster Agentic Systems](https://mlsanity.com/paper/2510.04371/) (2025)
- [RollArt: Disaggregated Multi-Task Agentic RL Training at Scale](https://mlsanity.com/paper/2512.22560/) (2025)
- [AgentCgroup: Understanding and Controlling OS Resources of AI Agents](https://mlsanity.com/paper/2602.09345/) (2026)
- [AnchorTP: Resilient LLM Inference with State-Preserving Elastic Tensor Parallelism](https://mlsanity.com/paper/2511.11617/) (2025)
- [FailSafe: High-performance Resilient Serving](https://mlsanity.com/paper/2511.14116/) (2025)
- [Making MoE-based LLM Inference Resilient with Tarragon](https://mlsanity.com/paper/2601.01310/) (2026)
- [VELOC: VEry Low Overhead Checkpointing in the Age of Exascale](https://mlsanity.com/paper/2103.02131/) (2021)
- [FailLite: Failure-Resilient Model Serving for Resource-Constrained Edge Environments](https://mlsanity.com/paper/2504.15856/) (2025)

## Built on by (most cited first, 13 of 13)

- [DeltaBox: Scaling Stateful AI Agents with Millisecond-Level Sandbox Checkpoint/Rollback](https://mlsanity.com/paper/2605.22781/) (2026)
- [FAVA: Formal Authorization for Verified Agents with Evidence-Backed Permission Graphs](https://mlsanity.com/paper/2607.27267/) (2026)
- [Resume Means Resume: A Machine-Checked Conformance Contract for Checkpoint, Interrupt, and Resume Semantics in Workflow Persistence Layers](https://mlsanity.com/paper/2608.03836/) (2026)
- [Business Arena: Benchmarking LLM Agents in a Realistic Marketplace](https://mlsanity.com/paper/2608.08621/) (2026)
- [Safe to Resume? Breaking Execution Continuity of Agent Execution via Rollback](https://mlsanity.com/paper/2608.29381/) (2026)
- [APPA: Recoverable Information-Flow Control for Real-World LLM Agents](https://mlsanity.com/paper/2607.24625/) (2026)
- [Towards an Agent Operating System - Lessons from Classical and Cloud OS](https://mlsanity.com/paper/2607.25076/) (2026)
- [Aborted but Not Forgotten: KV-Cache Retention Breaks Rollback Consistency in Language Agents](https://mlsanity.com/paper/2608.15939/) (2026)
- [REVISE: Validity-Guided Recovery for Online Revisions in Agent Workflows](https://mlsanity.com/paper/2609.00643/) (2026)
- [Recoverability as a System Primitive for Long-Horizon AI Agents](https://mlsanity.com/paper/2609.13672/) (2026)
- [CUA-Sandbox: Efficient Environments for Computer-Use Agent Reinforcement Learning](https://mlsanity.com/paper/2609.32750/) (2026)
- [RippleCP: Measuring Counterfactual Checkpoint Advantage in Coding Agents](https://mlsanity.com/paper/2610.09088/) (2026)
- [agent-risk: Risk Assessment for Changes to AI Agents](https://mlsanity.com/paper/2610.16280/) (2026)

## Abstract (arXiv)

Autonomous agents act through sandboxed containers and microVMs whose state spans filesystems, processes, and runtime artifacts. Checkpoint and restore (C/R) of this state is needed for fault tolerance, spot execution, RL rollout branching, and safe rollback-yet existing approaches fall into two extremes: application-level recovery preserves chat history but misses OS-side effects, while full per-turn checkpointing is correct but too expensive under dense co-location. The root cause is an agent-OS semantic gap: agent frameworks see tool calls but not their OS effects; the OS sees state changes but lacks turn-level context to judge recovery relevance. This gap hides massive sparsity: over 75% of agent turns produce no recovery-relevant state, so most checkpoints are unnecessary. Crab (Checkpoint-and-Restore for Agent SandBoxes) is a transparent host-side runtime that bridges this gap without modifying agents or C/R backends. An eBPF-based inspector classifies each turn's OS-visible effects to decide checkpoint granularity; a coordinator aligns checkpoints with turn boundaries and overlaps C/R with LLM wait time; and a host-scoped engine schedules checkpoint traffic across co-located sandboxes. On shell-intensive and code-repair workloads, Crab raises recovery correctness from 8% (chat-only) to 100%, cuts checkpoint traffic by up to 87%, and stays within 1.9% of fault-free execution time.