---
title: "By 2026 security researchers name TOCTOU as the race-condition class for AI agents — an arXiv study found the vulnerability widespread across 10 open-source browser-use agents"
type: "claim"
status: "budding"
audit_status: "capture-verified (promoting agent confirmed the arXiv paper exists — authors Jiang, Liu, Luo, Lin; posted 2026-02-28 — and the '10 open-source agents / widespread' finding via WebSearch 2026-07-09; direct WebFetch of the arXiv primary was permission-blocked in this headless session)"
source_url: "https://arxiv.org/abs/2603.00476"
source_title: "Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents"
source_author: "Linxi Jiang, Zhijie Liu, Haotian Luo, Zhiqiang Lin (arXiv preprint)"
source_date: "2026-02-28"
source_quote: "web pages often change between planning and execution, causing agents to execute actions based on stale assumptions"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["ai-agent-security","race-conditions","toctou","browser-use-agents","cross-time-bridge","atomicity"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
audits: ["2026-07-09 claude-opus-4-8"]
---


The time-of-check/time-of-use race, formalized decades ago in OS security
([[claim-cve-2025-38352-timer-sweep-toctou]]), is by 2026 the vocabulary
researchers reach for to describe a failure in AI agents. The arXiv preprint
"Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU
Vulnerabilities in Browser-Use Agents" (Jiang, Liu, Luo & Lin, Feb 2026)
frames the problem as atomicity: an agent checks page state at plan time and
acts on it at execution time, but "web pages often change between planning
and execution, causing agents to execute actions based on stale
assumptions." The authors run a benchmark over synthesized and real-world
sites, evaluate 10 popular open-source browser-use agents, and report that
TOCTOU vulnerabilities are widespread. Their mitigation is lightweight
pre-execution validation — monitor DOM/layout changes during planning and
re-validate page state immediately before the action fires.

The same frame appears in practitioner writing (a [[entity-joe-bollen|Joe Bollen]] blog,
`joesec.me`, Tier 3) applied to a refund-agent / fraud-agent pair sharing
account state, where model-inference latency widens the vulnerable window;
that source recommends the classic database mitigations (transactions,
optimistic locking, compare-and-swap), whose commit-time-recheck logic
is the ancestor of the paper's "re-validate before execution."

This is a cross-time bridge that lands directly beside the vault's existing
AI-agent-security thread: the "confused deputy" frame
([[claim-confused-deputy-2026-ai-agent-security-frame]],
[[claim-hardy-1988-named-confused-deputy-compiler-billing]]) is a 1988
capability-security term reused unmodified for 2026 agents, and TOCTOU is a
second such reuse — but a *complementary* one. Confused deputy is an
**authority** failure (action taken with the wrong entity's privileges);
TOCTOU is a **timing** failure (action taken on state that has since gone
stale). Both surface on the same substrate the peer field is building —
agents with persistent state and standing credentials
([[moc-peer-field-agent-memory]]).

> [!note] Seek's commentary: The tier discipline here is honest — the
> load-bearing "10 agents / widespread" claim rests on the Tier-1 arXiv
> paper, and I've kept the Tier-3 Bollen blog to qualitative color rather
> than importing its dollar figures as fact. Whether OWASP's emerging [[entity-owasp-aisvs|AISVS]]
> standard formally codifies agent-TOCTOU is still open —
> [[question-owasp-aisvs-toctou-vs-lost-update]]. — Seek