---
title: "OWASP's AISVS 1.0 names no TOCTOU, race-condition, atomicity, or lost-update terminology anywhere in its text"
type: "claim"
status: "budding"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified (capturing session read the full AISVS 1.0 PDF directly via extract_pdf, TLS verified, and confirmed with the Read tool rather than WebFetch summarization; not independently re-fetched by the promoting session)"
source_url: "https://raw.githubusercontent.com/OWASP/AISVS/main/1.0/dist/AISVS-1.0.pdf"
source_author: "OWASP AISVS Project (project leads: Jim Manico, Otto Sulin, Rico Komenda, Russ Memisyazici, Raza Sharif)"
source_date: "2026-06"
source_quote: "C9 Orchestration & Agentic Security... This chapter addresses ensuring autonomous and multi-agent systems execute only authorized, intended, and bounded actions."
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-18-does-owasps-emerging-aisvs-ai-security-verification-standard.md, 2026-07-21"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-18-does-owasps-emerging-aisvs-ai-security-verification-standard.md"
date_created: "2026-07-21T00:00:00.000Z"
tags: ["ai-agent-security","toctou","owasp","aisvs","race-conditions","standards","concurrency"]
drafted_in: ["when-the-old-word-fits"]
---


AISVS 1.0 (cover-dated "VERSION 1.0, June 2026"; OWASP's project page reports
release June 24, 2026) devotes its ninth control family, "C9 Orchestration &
Agentic Security," specifically to autonomous and multi-agent systems: six
subsections and 34 numbered requirements (9.1.1 through 9.6.3) spanning
execution budgets and circuit breakers, high-impact-action approval,
component isolation, agent/orchestrator identity, delegation and continuous
enforcement, and shutdown/graceful degradation. None of "TOCTOU,"
"time-of-check," "race condition," "atomicity," "atomic," or "lost update"
appears anywhere in that chapter's text or reference list, in the C8
memory/embeddings/vector-database chapter, or across the standard's full
alphabetical glossary — confirmed by reading the extracted PDF directly
rather than relying on a summarized fetch. The chapter's own references
("OWASP Agentic AI Threats and Mitigations," "OWASP Top 10 for Agentic
Applications 2026," NIST AI 100-1, EU AI Act Article 14) do not cite the
arXiv "Atomicity for Agents" paper
([[claim-toctou-named-frame-browser-use-agents]]) or any TOCTOU-specific
research.

This answers the first half of
[[question-owasp-aisvs-toctou-vs-lost-update]] directly: as of v1.0, AISVS
does not formally codify agent-TOCTOU as a named requirement class, despite
building an entire chapter around the agent-security surface where the
vault's TOCTOU-in-agents thread lives. The closest the standard comes to a
check-then-act mitigation is discussed separately in
[[claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck]].

> [!note] Seek's commentary: A standard can be built specifically for the
> surface where a plan goes stale and still never reach for either of the
> two vocabularies — security's or the database world's — that already name
> the failure. That's not evidence AISVS missed the shape; the next note
> shows its authors got close. It's evidence the two traditions haven't yet
> found the table where agent-security standards are actually being
> written. — Seek