> Your AI agent deleted or changed something that matters? Stop it, cut its access, save its log, find what changed and restore it, one tool at a time. [Delta MCP](https://www.mcpdelta.com/) [Guides](https://www.mcpdelta.com/guides) Guide # AI agent deleted or changed data? What to do first Updated 13 October 20267 min read By the Delta MCP team The short answer Stop the agent first, then cut off the access it used so nothing else can change. Save the record of what it did, and work out what it changed before you fix anything. Restore one tool at a time, starting with whatever has a deadline. Some things, such as a message already sent, will not come back. ## What should you do first, and in what order? Do these in order. The first two keep the damage from growing. The rest let you repair it from facts, not guesses. NIST’s incident-response guidance has the same building blocks: contain, analyze, restore, notify, learn. 1. **Stop the agent** Right now Make your AI stop acting, then check that nothing restarts it. In Claude Code, press Esc: it stops the current response or tool call. Subagents running in the background have their own stop: press Ctrl+X Ctrl+K twice within 3 seconds. In another AI app, use its own stop control. A Claude Code routine runs on its schedule, with no one approving its actions, until you pause it. 2. **Cut off its access** Next Take away the key your AI was using, so it cannot act again. In Claude Code, open `/mcp` and choose **Clear authentication**: the docs give it as the way to revoke access. Then revoke the key at the service too. On GitHub, delete the personal access token (Settings, Developer settings). If you signed in through an app, revoke it under Settings, Applications, Authorized OAuth Apps. A revoked token cannot be restored, only replaced. In Notion, workspace owners manage connected AI apps under Settings, Connections. A key the agent read from a file such as `.env` is now in a plain-text log on your disk. Replace it too. 3. **Keep the record** Before it is cleaned up Copy your AI’s log somewhere safe before you change anything. Write down each step you take, with the time. Claude Code writes every message, tool call and result of a session to a `.jsonl` file under `~/.claude/projects`. It deletes the file after 30 days by default. Take screenshots of what each tool shows now. NIST’s guidance asks that response actions are recorded and the records kept intact. 4. **Find everything it changed** Before you restore Do not restore yet. Your AI may have changed more than the one thing you noticed. List every tool it could reach and check each one with the table below. NIST warns that a superficial check can underestimate an incident’s magnitude. A connected Notion client can reach any content you can reach. 5. **Tell the people who rely on it** Then Tell teammates, customers or anyone who uses what changed. Say what you know, and what you don’t know yet. NIST’s guidance lists notifying internal and external stakeholders as a response task, and sharing recovery progress with them. 6. **Restore only what changed** Last Put back what changed, starting with whatever expires first. Then check each item against the log. NIST’s recovery guidance favors precision, such as restoring only the affected files. It also says to fix the root cause and verify a restoration before the restored item goes back into use. ## Where do you look to see what changed? Start with your AI’s own log: it lists what it did, in order. Then open each tool’s history to see the effect. Where to see what an AI agent changed, and how far back each record goes | Where | What you find | How far back | | --- | --- | --- | | Your AI’s log, in Claude Code | Every message, tool call and result of a session, in `~/.claude/projects`. | 30 days by default. | | GitHub, your account | The security log, under Settings: who acted, in which repository, what they did and when. | 90 days. | | GitHub, an organization | The audit log, for owners only. Search by actor, repository or action. | 180 days. The last three months show by default. | | A Notion page | Version history, in the **•••** menu (it needs **Can edit** access): earlier versions, with the changes highlighted. | 7 days on Free, 30 on Plus, 90 on Business, any number on Enterprise. | | Notion, deleted pages | Trash lists them, and filters by who last edited them. | 30 days by default. | | Your files | `git status` lists the paths that differ from your last commit. | Since your last commit. | Read the log from the first change forward, and write the order down. NIST’s analysis guidance starts there: the sequence of events, and the assets each one involved. ## How long do you have to restore it? Put back only what changed, and start with whatever expires first. Version history deadlines are in the table above. How long you have to restore what an AI agent deleted or changed | What was lost | How long you have | Good to know | | --- | --- | --- | | A GitHub repository | **90 days.** | It can take up to an hour after deletion before you can restore it. A repository in a fork network that is not empty cannot be restored until the others are deleted or detached. | | A Notion page in Trash | **30 days by default.** | Notion then keeps it 30 more days before it becomes inaccessible to every user, owners included. You can ask Notion’s support: it says it can restore a snapshot from the past 30 days. | | A file Claude Code edited | **About 30 days after the session’s last checkpoint.** | `/rewind` undoes edits made with Claude’s file tools, not `rm`, `mv` or `cp` run in the shell. | When you have restored something, compare it with the log. NIST asks you to verify a restoration before you rely on it. [How to restore each one, step by step](https://www.mcpdelta.com/guides/undo-ai-agent-changes) ## What cannot be brought back? Some things stay done. Know which ones early, so that you tell people the truth. - A message that went out Gmail’s Undo Send lasts only 5, 10, 20 or 30 seconds, the period you set. Restoring a page does not recall a message already delivered. Do this Send a correction, and tell the people who received it. - A key you revoked GitHub says an expired or revoked token cannot be restored. You create a new one. Do this Make the new key narrower than the old one. - What the agent read A connected Notion client may send content it read to systems outside Notion. Restoring does not take that back. Do this Treat what it read as seen. Replace any secret in it. - What a restore leaves out A restored GitHub repository gets no team permissions back. A restored Notion database gets its pages and properties back, not the text inside them. Do this Check permissions, then page contents, by hand. ## How do you stop it happening again? Give your AI less to break, make it ask before it deletes, and keep a copy it cannot reach. Then write it up. NIST ends with an after-action report: the incident, the actions taken, the lessons learned. - Make it ask first In Claude Code, `deny` rules are checked first, then `ask`, then `allow`. A rule can name one MCP tool, like `mcp__server__tool`. Notion advises turning on confirmation before actions that change content. Do this Open `/permissions` and add an `ask` rule for each tool that deletes or sends. - Give it a narrow key A fine-grained GitHub token can be limited to chosen repositories and specific permissions. A connected Notion client reaches everything you can reach. Do this Use the narrowest key that does the job, with an expiry date. - Keep a copy it cannot reach A copy outside your AI’s reach survives its mistakes. Git keeps what you have committed. Do this Commit often, and keep a backup the agent has no key for. - Know that a rule is not a wall Claude Code’s docs say a Bash rule is not a security boundary. `Bash(rm *)` stops `rm -rf build/` but not `bash -c 'rm -rf build/'`. Do this For a hard limit, turn on the sandbox. [Every setting, tool by tool](https://www.mcpdelta.com/guides/safe-ai-access-mcp) ## How does Delta MCP help when this happens? Delta MCP is a free app on your computer. It sits between your AI and tools such as Notion, GitHub, Linear and Vercel. It keeps every change your AI makes through it, so “what changed?” already has an answer. - A record of every task Activity lists each task as one sentence, such as “Set status to Archive on 4 pages in Notion”. Open it to see each change, before and after. - Undo that tells you first Click **Undo** on a task and a sheet says what it will do first. It lists changes put back and checked, deleted items back as new copies, and new items deleted. Some actions, such as a message already sent, cannot be undone. Delta MCP tells you which, before you click and again after. - A mode for each connector Each tool you connect is a connector, and each gets a mode. There are four: **Change on its own**, **Ask before deleting or sending**, **Ask before every change** and **Read only**. When you need to be sure, pick **Ask before every change**. - A record you can keep **Export everything**, in Settings, saves your tasks and their journal as one readable file. Each journal line is chained to the one before, so a removed or edited line shows. Activity lists what your AI did through Delta MCP. A change made some other way is not in it. [How Activity and Undo work](https://www.mcpdelta.com/docs/activity-and-undo) ### Try Delta MCP on your own tasks Free, two minutes to set up, and you can put everything back in one click. [Download for Mac](https://www.mcpdelta.com/download) Free · No account · Put everything back in one click ## Questions ### What should I do first when an AI agent deletes data? Stop it, then cut its access. In Claude Code, press Esc and check for routines that could restart it. Revoke the key it used, save its log, and find what changed in each tool before you restore anything. ### Can I recover data an AI agent deleted? Often, inside the deadline. GitHub can restore a deleted repository within 90 days, unless it was in a fork network that is not empty. A Notion page stays in Trash 30 days by default. Its version history goes back 7, 30 or 90 days on Free, Plus and Business. Files come back from Git or a backup. Claude Code’s rewind does not cover files that a shell command deleted. ### How do I find out what an AI agent changed? Start with the agent’s own log. Claude Code keeps every tool call and result under `~/.claude/projects` for 30 days by default. Then check each tool. GitHub has a security log (90 days) and an audit log (180 days, owners only). Notion has version history and Trash. ### Should I revoke my AI agent’s API key or token? Yes, if it can act on a service on its own. Delete the token and make a new, narrower one: GitHub says a revoked token cannot be restored. Replace any key the agent read from a file too. ### Can Claude Code’s /rewind undo what the agent did? Only edits made through its file editing tools. Changes made by shell commands such as `rm`, `mv` or `cp` are not tracked. Claude Code’s docs say checkpoints do not replace version control. ### Can Delta MCP undo what my AI changed? For tasks that went through Delta MCP, in part. Undo on a task in Activity puts back what it can and checks it. It tells you before and after what it cannot, such as a message already sent. Changes made outside Delta MCP are not in Activity. ## Sources 1. [**NIST**, Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile](https://csrc.nist.gov/pubs/sp/800/61/r3/final) (Apr 2025) Contain, analyze, restore, notify, verify, after-action report (SP 800-61 Rev. 3). 2. [**Claude Code**, Interactive mode](https://code.claude.com/docs/en/interactive-mode) Esc stops the current response or tool call. 3. [**Claude Code**, Automate work with routines](https://code.claude.com/docs/en/routines) Routines run on a schedule without approval until paused. 4. [**Claude Code**, Connect Claude Code to tools via MCP](https://code.claude.com/docs/en/mcp) Clear authentication in /mcp revokes access. 5. [**Claude Code**, Explore the .claude directory](https://code.claude.com/docs/en/claude-directory) Where transcripts live, the 30-day default, and that a key read from a file lands in the plain-text log. 6. [**Claude Code**, Checkpointing](https://code.claude.com/docs/en/checkpointing) What /rewind restores, and that shell commands are not tracked. 7. [**Claude Code**, Configure permissions](https://code.claude.com/docs/en/permissions) Deny, ask, allow order, MCP rule names, and why a Bash rule is not a boundary. 8. [**GitHub**, Managing your personal access tokens](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) Deleting a token, and what a fine-grained token can be limited to. 9. [**GitHub**, Reviewing your authorized OAuth apps](https://docs.github.com/en/apps/oauth-apps/using-oauth-apps/reviewing-your-authorized-oauth-apps) Revoking an authorized app, one by one or all at once. 10. [**GitHub**, Token expiration and revocation](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/token-expiration-and-revocation) A revoked or expired token cannot be restored. 11. [**GitHub**, Reviewing your security log](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/reviewing-your-security-log) The 90-day log of a personal account. 12. [**GitHub**, Reviewing the audit log for your organization](https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-security-settings-for-your-organization/reviewing-the-audit-log-for-your-organization) Owners only, 180 days, search by actor, repository or action. 13. [**GitHub**, Restoring a deleted repository](https://docs.github.com/en/repositories/creating-and-managing-repositories/restoring-a-deleted-repository) The 90-day window, the delay, fork networks, team permissions. 14. [**Notion**, Delete & restore content](https://www.notion.com/help/duplicate-delete-and-restore-content) Trash and version history retention, database restores, the 30-day snapshot. 15. [**Notion**, Security best practices](https://developers.notion.com/guides/mcp/mcp-security-best-practices) A connected client reaches what you reach, may send content outside Notion; confirm before changes. 16. [**Google**, Send or unsend Gmail messages](https://support.google.com/mail/answer/2819488) Undo Send works for 5, 10, 20 or 30 seconds. 17. [**Git**, git-status Documentation](https://git-scm.com/docs/git-status) git status lists the paths that differ from the last commit. 18. [**Delta MCP**, Activity and Undo](https://www.mcpdelta.com/docs/activity-and-undo) Activity, Undo, the journal and the export. 19. [**Delta MCP**, Modes](https://www.mcpdelta.com/docs/modes) The four modes. ## Keep reading - [How to undo what an AI agent did in Notion, GitHub and files An AI agent changed or deleted something? See what changed, undo it in Notion, GitHub or your files, and what can never be taken back.](https://www.mcpdelta.com/guides/undo-ai-agent-changes) - [How to give an AI access to your tools safely (MCP) MCP permissions in plain words: four access levels, where to set them in Claude, Cursor, VS Code, GitHub and Notion, and how to start read-only.](https://www.mcpdelta.com/guides/safe-ai-access-mcp)  ## Try Delta MCP on your own tasks Free, two minutes to set up, and you can put everything back in one click. [Download for Mac](https://www.mcpdelta.com/download) Also for [Windows](https://www.mcpdelta.com/download#windows) [Linux](https://www.mcpdelta.com/download#linux) Free · No account · Apple chip or Intel