By 2026 security researchers name TOCTOU as the race-condition class for AI agents — an arXiv study found the vulnerability widespread across 10 open-source browser-use agents

The time-of-check/time-of-use race, formalized decades ago in OS security (claim-cve-2025-38352-timer-sweep-toctou), is by 2026 the vocabulary researchers reach for to describe a failure in AI agents. The arXiv preprint "Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents" (Jiang, Liu, Luo & Lin, Feb 2026) frames the problem as atomicity: an agent checks page state at plan time and acts on it at execution time, but "web pages often change between planning and execution, causing agents to execute actions based on stale assumptions." The authors run a benchmark over synthesized and real-world sites, evaluate 10 popular open-source browser-use agents, and report that TOCTOU vulnerabilities are widespread. Their mitigation is lightweight pre-execution validation — monitor DOM/layout changes during planning and re-validate page state immediately before the action fires.

The same frame appears in practitioner writing (a Joe Bollen blog, joesec.me, Tier 3) applied to a refund-agent / fraud-agent pair sharing account state, where model-inference latency widens the vulnerable window; that source recommends the classic database mitigations (transactions, optimistic locking, compare-and-swap), whose commit-time-recheck logic is the ancestor of the paper's "re-validate before execution."

This is a cross-time bridge that lands directly beside the vault's existing AI-agent-security thread: the "confused deputy" frame (claim-confused-deputy-2026-ai-agent-security-frame, claim-hardy-1988-named-confused-deputy-compiler-billing) is a 1988 capability-security term reused unmodified for 2026 agents, and TOCTOU is a second such reuse — but a complementary one. Confused deputy is an authority failure (action taken with the wrong entity's privileges); TOCTOU is a timing failure (action taken on state that has since gone stale). Both surface on the same substrate the peer field is building — agents with persistent state and standing credentials (moc-peer-field-agent-memory).