---
id: "20260709-1720-hop-toctou-timer-sweep-ai-agents"
title: "A timer sweep racing an in-flight write is CWE-367 (TOCTOU) — and it's now the named vulnerability class for AI multi-agent orchestration"
type: "capture"
status: "promoted"
origin: "hop-batch"
promoted_to: ["30-notes/claim-cve-2025-38352-timer-sweep-toctou.md (Claim 1 — CVE-2025-38352 timer-sweep-vs-deletion race = CWE-367 TOCTOU; Tier 1, web-verified 2026-07-09)","30-notes/claim-toctou-named-frame-browser-use-agents.md (Claim 2 — TOCTOU as the 2026 AI-agent race-condition frame, 10 browser-use agents; Tier 1 arXiv 2603.00476, web-verified)","30-notes/claim-lost-update-p4-distinct-from-toctou.md (Claim 3 — lost-update P4 is a distinct DB lineage, not a TOCTOU synonym; Tier 1 Berenson 1995)"]
routed_questions: ["50-questions/question-owasp-aisvs-toctou-vs-lost-update.md (does OWASP AISVS codify agent-TOCTOU / distinguish it from lost-update)"]
not_promoted: ["Kung & Robinson 1981 optimistic concurrency control as the mitigation lineage (hop 5) — folded as a brief mention into claim-toctou-named-frame-browser-use-agents rather than a standalone note; the source was not verified this session and the 'OCC reframed as pre-execution validation for agents' link is interpretive synthesis, not a sourced claim.","TOCTOU historical origin (McPhee 1974 / RISOS project 1976, hop 4) — skipped: the capture itself records 'no single URL, cross-referenced via search,' so it fails the attribution floor (spec §4, no claim without a citable source). The term's decades-old age is mentioned qualitatively in the notes without asserting the specific 1974/1976 attribution.","Bollen '$4,800 left the system before the freeze landed' figure (hop 2, Tier 3 blog) — not promoted as a fact: a quantitative claim on a Tier-3 source. Bollen's refund-agent/fraud-agent example is kept only as qualitative practitioner color."]
model: "claude-sonnet-5"
date_created: "2026-07-09T00:00:00.000Z"
hop_chain: ["seed: is a timer sweeping an in-flight write a named failure mode (lost update, TOCTOU)? -> CVE-2025-38352, Linux posix-cpu-timers race, CWE-367 (max_cosine 0.621)","CVE-2025-38352 / CWE-367 TOCTOU -> Joe Bollen's application of TOCTOU to multi-agent AI billing/fraud systems (max_cosine 0.664)","Bollen blog -> arXiv 'Atomicity for Agents': TOCTOU vulnerabilities evaluated across 10 browser-use agents (same band, ~0.664)","TOCTOU term -> historical origin, McPhee 1974 / RISOS project 1976 (grounding/history hop, no separate novelty check)","TOCTOU's classic mitigation -> Kung & Robinson 1981 optimistic concurrency control (max_cosine 0.675)","OCC / 'lost update' -> Berenson et al. 1995 ANSI SQL critique: P4 lost-update is a distinct database-transaction lineage, not a TOCTOU synonym (grounding hop)"]
novelty_max_cosine: 0.664
tags: ["concurrent-systems","race-conditions","ai-agent-security","cross-domain-bridge","cross-time-bridge"]
source_1_url: "https://nvd.nist.gov/vuln/detail/CVE-2025-38352"
source_1_tier: 1
source_2_url: "https://arxiv.org/abs/2603.00476"
source_2_tier: 1
source_3_url: "https://mwhittaker.github.io/papers/html/berenson1995critique.html"
source_3_tier: 1
source_4_url: "https://joesec.me/articles/toctou-agents/"
source_4_tier: 3
---


## Claim 1 — Yes: a timer sweep racing an in-flight teardown is a formally named failure mode, CWE-367

CVE-2025-38352 is a real, exploited-in-the-wild Linux kernel bug where the timer-processing sweep races a concurrent deletion.

> "posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()" — classified as **CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition**.

source_url: https://nvd.nist.gov/vuln/detail/CVE-2025-38352 — source_tier: 1 (NVD, official CVE record).

## Claim 2 — TOCTOU is now the named frame for AI multi-agent race conditions, at measured scale

> "web pages often change between planning and execution, causing agents to execute actions based on stale assumptions."

Researchers evaluated 10 open-source browser-use agents and found TOCTOU vulnerabilities widespread.

source_url: https://arxiv.org/abs/2603.00476 — source_tier: 1 (arXiv preprint).

## Claim 3 — "Lost update" is a different, older lineage, not a TOCTOU synonym

Lost update (P4) is a database-transaction anomaly, defined via history notation `r1[x] w2[x] w1[x] c1` — T1 reads, T2 writes, T1's stale-based write clobbers it.

source_url: https://mwhittaker.github.io/papers/html/berenson1995critique.html — source_tier: 1 (primary paper text).

## Why this was hop-worthy

Two independent 1970s/1990s formalisms (OS security's TOCTOU, database theory's lost-update/OCC) turn out to be the exact, still-separate vocabularies 2026 AI-agent-security researchers reach for — a double cross-time bridge landing next to the vault's existing agent-security thread (confused deputy, captured same day).

## Further leads

- Kung & Robinson 1981 "optimistic concurrency control" is the classic mitigation Bollen recommends verbatim for AI agents — unresearched deeper.
- Whether AISVS (OWASP's emerging AI agent security standard) formally distinguishes TOCTOU from lost-update — unresearched.

> [!note] Seek's commentary:
> The genuinely surprising part isn't the bridge (old security term → new AI problem is a pattern this vault already has, via confused deputy). It's that the seed's "lost update, TOCTOU" pairing turned out to be a false synonym — two distinct formal traditions that just happen to look identical in an AI agent's execution trace.

## Hop chain

Hop 1: NVD — CVE-2025-38352 — https://nvd.nist.gov/vuln/detail/CVE-2025-38352
- Hook type: mechanism question / unfamiliar name
- Hook: a real, currently-exploited kernel bug where `handle_posix_cpu_timers()` (the timer sweep) races `posix_cpu_timer_del()` (deletion mid-flight), classified CWE-367
- Why followed: this is the most literal possible answer to the seed question — does the exact scenario described have a name in the wild
- Key findings: yes — CWE-367 (TOCTOU), CVSS 7.4, used in limited targeted exploitation per the September 2025 Android security bulletin; the race ends in use-after-free of a `k_itimer` struct.

Hop 2: Joe Bollen — "TOCTOU Race Conditions in Multi-Agent Systems" — https://joesec.me/articles/toctou-agents/
- Hook type: cross-domain bridge
- Hook: the same CWE-367 concept applied to a Refund Agent / Fraud Agent pair sharing account state, where model-inference latency widens the vulnerable window
- Why followed: cross-domain bridges are the protocol's highest-priority hook, and this one moves TOCTOU from kernel internals into the vault's live agent-architecture interest
- Key findings: "$4,800 left the system before the freeze landed" — both agents behaved correctly in isolation; the bug is purely in the timing gap. Bollen names CWE-367 explicitly and recommends transactions/optimistic locking/compare-and-swap.

Hop 3: arXiv — "Atomicity for Agents: ... TOCTOU Vulnerabilities in Browser-Use Agents" — https://arxiv.org/abs/2603.00476
- Hook type: mechanism question (evidence-tier upgrade of the same bridge)
- Hook: an academic, measured version of Bollen's claim — DOM/page state checked at plan-time can change before execution
- Why followed: wanted a Tier 1 source for the cross-domain claim rather than resting it on a blog
- Key findings: evaluated 10 open-source browser-use agents, found the vulnerability widespread, proposed pre-execution state re-validation as mitigation.

Hop 4: search synthesis — TOCTOU historical origin (McPhee 1974; RISOS project, NBS, 1976) — no single URL, cross-referenced via search
- Hook type: cross-domain bridge (cross-time-period variant)
- Hook: the term's ~50-year age relative to its 2026 AI-agent reuse
- Why followed: zoom-out after two zoom-in hops, per the protocol's alternation rule
- Key findings: TOCTOU was identified as a synchronization-error class by 1974-76 government/university security-evaluation projects, decades before "AI agent" had any meaning.

Hop 5: Kung & Robinson (1981) — "On Optimistic Methods for Concurrency Control" — https://www.eecs.harvard.edu/~htk/publication/1981-tods-kung-robinson.pdf
- Hook type: mechanism question (zoom in on the mitigation Bollen cited)
- Hook: "optimistic locking," the fix Bollen recommends for AI agents, traces to a specific 45-year-old database paper
- Why followed: naming a mitigation without naming its origin felt incomplete
- Key findings: OCC lets transactions proceed lock-free and only checks for conflicts at commit time, rolling back on collision — the same commit-time-recheck logic later reframed as "pre-execution validation" for AI agents.

Hop 6: Berenson, Bernstein, Gray et al. (1995) — "A Critique of ANSI SQL Isolation Levels" — https://mwhittaker.github.io/papers/html/berenson1995critique.html
- Hook type: surprising claim
- Hook: "lost update" has its own formal definition (P4) inside database isolation-level theory, independent of the TOCTOU/security lineage the rest of this chain came from
- Why followed: closing the seed's explicit "lost update, TOCTOU" pairing — are they the same thing?
- Key findings: they are not synonyms. TOCTOU is security/OS vocabulary for a check-then-act race; lost update (P4) is database-transaction vocabulary for a stale-read-then-write clobber. Same phenomenon-shape, two separate 20th-century naming traditions.

Saved hooks not followed:
- OWASP AISVS (AI Security Verification Standard) — from the Bollen post — Bollen claims contribution to it; whether it formally codifies agent-TOCTOU is unresearched, saved as a question.
- Jim Gray (Turing Award, Berenson et al. co-author) as a "person behind the thing" — recognizable name, not chased this run to keep the chain on the concurrency thread rather than branching into a biography.
- CVE-2025-38352's specific Android in-the-wild exploitation chain — technical rabbit hole, saved rather than opened.

post-worthy: maybe — strong double cross-time bridge and a real conceptual correction (TOCTOU ≠ lost update), but it's the second "old security term meets 2026 AI agents" capture from this session, so triage should decide if both survive or merge.