A timer sweep racing an in-flight write is CWE-367 (TOCTOU) — and it's now the named vulnerability class for AI multi-agent orchestration

Claim 1 — Yes: a timer sweep racing an in-flight teardown is a formally named failure mode, CWE-367

CVE-2025-38352 is a real, exploited-in-the-wild Linux kernel bug where the timer-processing sweep races a concurrent deletion.

"posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()" — classified as CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition.

source_url: https://nvd.nist.gov/vuln/detail/CVE-2025-38352 — source_tier: 1 (NVD, official CVE record).

Claim 2 — TOCTOU is now the named frame for AI multi-agent race conditions, at measured scale

"web pages often change between planning and execution, causing agents to execute actions based on stale assumptions."

Researchers evaluated 10 open-source browser-use agents and found TOCTOU vulnerabilities widespread.

source_url: https://arxiv.org/abs/2603.00476 — source_tier: 1 (arXiv preprint).

Claim 3 — "Lost update" is a different, older lineage, not a TOCTOU synonym

Lost update (P4) is a database-transaction anomaly, defined via history notation r1[x] w2[x] w1[x] c1 — T1 reads, T2 writes, T1's stale-based write clobbers it.

source_url: https://mwhittaker.github.io/papers/html/berenson1995critique.html — source_tier: 1 (primary paper text).

Why this was hop-worthy

Two independent 1970s/1990s formalisms (OS security's TOCTOU, database theory's lost-update/OCC) turn out to be the exact, still-separate vocabularies 2026 AI-agent-security researchers reach for — a double cross-time bridge landing next to the vault's existing agent-security thread (confused deputy, captured same day).

Further leads

• Kung & Robinson 1981 "optimistic concurrency control" is the classic mitigation Bollen recommends verbatim for AI agents — unresearched deeper.
• Whether AISVS (OWASP's emerging AI agent security standard) formally distinguishes TOCTOU from lost-update — unresearched.

Hop chain

Hop 1: NVD — CVE-2025-38352 — https://nvd.nist.gov/vuln/detail/CVE-2025-38352

• Hook type: mechanism question / unfamiliar name
• Hook: a real, currently-exploited kernel bug where handle_posix_cpu_timers() (the timer sweep) races posix_cpu_timer_del() (deletion mid-flight), classified CWE-367
• Why followed: this is the most literal possible answer to the seed question — does the exact scenario described have a name in the wild
• Key findings: yes — CWE-367 (TOCTOU), CVSS 7.4, used in limited targeted exploitation per the September 2025 Android security bulletin; the race ends in use-after-free of a k_itimer struct.

Hop 2: Joe Bollen — "TOCTOU Race Conditions in Multi-Agent Systems" — https://joesec.me/articles/toctou-agents/

• Hook type: cross-domain bridge
• Hook: the same CWE-367 concept applied to a Refund Agent / Fraud Agent pair sharing account state, where model-inference latency widens the vulnerable window
• Why followed: cross-domain bridges are the protocol's highest-priority hook, and this one moves TOCTOU from kernel internals into the vault's live agent-architecture interest
• Key findings: "$4,800 left the system before the freeze landed" — both agents behaved correctly in isolation; the bug is purely in the timing gap. Bollen names CWE-367 explicitly and recommends transactions/optimistic locking/compare-and-swap.

Hop 3: arXiv — "Atomicity for Agents: ... TOCTOU Vulnerabilities in Browser-Use Agents" — https://arxiv.org/abs/2603.00476

• Hook type: mechanism question (evidence-tier upgrade of the same bridge)
• Hook: an academic, measured version of Bollen's claim — DOM/page state checked at plan-time can change before execution
• Why followed: wanted a Tier 1 source for the cross-domain claim rather than resting it on a blog
• Key findings: evaluated 10 open-source browser-use agents, found the vulnerability widespread, proposed pre-execution state re-validation as mitigation.

Hop 4: search synthesis — TOCTOU historical origin (McPhee 1974; RISOS project, NBS, 1976) — no single URL, cross-referenced via search

• Hook type: cross-domain bridge (cross-time-period variant)
• Hook: the term's ~50-year age relative to its 2026 AI-agent reuse
• Why followed: zoom-out after two zoom-in hops, per the protocol's alternation rule
• Key findings: TOCTOU was identified as a synchronization-error class by 1974-76 government/university security-evaluation projects, decades before "AI agent" had any meaning.

Hop 5: Kung & Robinson (1981) — "On Optimistic Methods for Concurrency Control" — https://www.eecs.harvard.edu/~htk/publication/1981-tods-kung-robinson.pdf

• Hook type: mechanism question (zoom in on the mitigation Bollen cited)
• Hook: "optimistic locking," the fix Bollen recommends for AI agents, traces to a specific 45-year-old database paper
• Why followed: naming a mitigation without naming its origin felt incomplete
• Key findings: OCC lets transactions proceed lock-free and only checks for conflicts at commit time, rolling back on collision — the same commit-time-recheck logic later reframed as "pre-execution validation" for AI agents.

Hop 6: Berenson, Bernstein, Gray et al. (1995) — "A Critique of ANSI SQL Isolation Levels" — https://mwhittaker.github.io/papers/html/berenson1995critique.html

• Hook type: surprising claim
• Hook: "lost update" has its own formal definition (P4) inside database isolation-level theory, independent of the TOCTOU/security lineage the rest of this chain came from
• Why followed: closing the seed's explicit "lost update, TOCTOU" pairing — are they the same thing?
• Key findings: they are not synonyms. TOCTOU is security/OS vocabulary for a check-then-act race; lost update (P4) is database-transaction vocabulary for a stale-read-then-write clobber. Same phenomenon-shape, two separate 20th-century naming traditions.

Saved hooks not followed:

• OWASP AISVS (AI Security Verification Standard) — from the Bollen post — Bollen claims contribution to it; whether it formally codifies agent-TOCTOU is unresearched, saved as a question.
• Jim Gray (Turing Award, Berenson et al. co-author) as a "person behind the thing" — recognizable name, not chased this run to keep the chain on the concurrency thread rather than branching into a biography.
• CVE-2025-38352's specific Android in-the-wild exploitation chain — technical rabbit hole, saved rather than opened.

post-worthy: maybe — strong double cross-time bridge and a real conceptual correction (TOCTOU ≠ lost update), but it's the second "old security term meets 2026 AI agents" capture from this session, so triage should decide if both survive or merge.