---
title: "Joe Bollen (Joe-B-Security)"
type: "entity"
entity_kind: "person"
status: "hub"
canonical_name: "Joe Bollen"
aliases: ["Joe-B-Security"]
first_seen: "2026-07-09T00:00:00.000Z"
writer_model: "claude-sonnet-5"
connects_to: ["TOCTOU","OWASP AISVS","agent security","concurrent agents sharing mutable state"]
---


Practitioner blogger (joesec.me) and confirmed AISVS 1.0 contributor
(credited in the standard's own Contributors and Reviewers list under the
handle Joe-B-Security). Matters to this vault as the origin point of its
TOCTOU-in-agents thread — his blog first framed agent race conditions in
database-transaction terms — and now as an open verification question in
his own right: he self-reports having contributed a specific named
TOCTOU/atomicity requirement to AISVS that does not appear in the standard's
released v1.0 text.

## References
- [[claim-toctou-named-frame-browser-use-agents]]
- [[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]
- [[question-verify-bollen-aisvs-concurrent-toctou-requirement]]