Old security vocabulary and the AI agent — reuse, conflation, and the standard that names none of it

ai-agent-securitytoctouconfused-deputylost-updateaisvsvocabulary-reuseattribution

The recurring argument in this cluster is not "AI agents have a new race condition." It is that the failure modes agents exhibit in 2026 already had names — some from 1988 operating-systems research, some from 1995 database theory — and the field is reaching for those old names unevenly: one transplants unmodified, two get quietly conflated, and the field's flagship standard reaches for none of them, even after one of them was merged into its own source text and then dropped before release. The interesting object here is the naming, not the vulnerability.

This is deliberately titled for the argument, not for AISVS — which is the most-mentioned referent but not the recurring point. (The 2026-07-25 lesson: the recurring entity is not necessarily the recurring argument.)

The term that transplanted unmodified

• claim-hardy-1988-named-confused-deputy-compiler-billing — Norman Hardy's 1988 SIGOPS paper coined "confused deputy" for a Fortran compiler that, holding authority from two sources ("home files license" for its own stats file), was tricked by a user-supplied argument into overwriting the system billing file. A comically small failure — one compiler, one lost file — but the shape is exact: authority attached to the wrong entity, exploitable because the deputy is trusted.
• claim-confused-deputy-2026-ai-agent-security-frame — thirty-eight years later a 2026 SANS post (Kenneth G. Hartman) applies the frame directly and unmodified to AI agents holding broad, aggregated credentials steered by attacker-controllable natural language. It is reused, not adapted or renamed — which, as the note's commentary puts it, is usually a sign a concept was right about the structure rather than the era. (Note the provenance care: the SANS post cites AWS's confused-deputy docs, not Hardy 1988; the 1988 attribution is the vault's own, via the Hardy note.)

The two lineages that only look like synonyms

The failure everyone points at — an agent checks page/world state at plan time and acts on stale state at execution time — has two independent 20th-century formalisms, and the cluster's genuinely surprising payload is that they are not the same thing.

• claim-toctou-named-frame-browser-use-agents — the OS-security lineage: a Feb-2026 arXiv study (Jiang, Liu, Luo, Lin) names TOCTOU (time-of-check/time-of-use) as the race-condition class for browser-use agents and finds it widespread across ten open-source agents.
• claim-lost-update-p4-distinct-from-toctou — the database lineage: "lost update" (phenomenon P4, formalised by Berenson, Bernstein, Gray et al. in SIGMOD 1995) is the same phenomenon-shape from a separate naming tradition — not a synonym for TOCTOU. Same trace, two vocabularies, and each imports a different set of mitigations. This false-synonym correction is the load-bearing note: the two words are not interchangeable, and treating them as one hides which mitigation actually applies.

The standard that names none of it

• claim-aisvs-1-0-omits-toctou-and-lost-update-terminology — OWASP's AISVS 1.0 (released 2026-06-24) devotes its whole C9 chapter (34 requirements across six subsections) to agentic security and never uses TOCTOU, time-of-check, race condition, atomicity, or lost update. A standard built for exactly the surface where a plan goes stale reaches for neither of the two existing vocabularies that already name the failure.
• claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck — its nearest check-then-act mitigation (requirement 9.5.6, Level 3) re-evaluates authorization policy before a privileged action, not world state. Freshness of permission is not freshness of the world — narrower than either the TOCTOU or the lost-update tradition addresses.
• claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement — and the omission is not because no one proposed it. Joe Bollen reports contributing a named TOCTOU/atomicity requirement for concurrent agents. A 2026-07-28 cross-model audit confirmed the mechanism: GitHub issue #640 and PR #641 are real, merged 2026-04-05 by Jim Manico as requirement 9.8.8 (concurrent agents on shared mutable state), then removed or renumbered in the May–June editorial passes before the release lock. The vocabulary literally reached the standard's source file and was dropped before it shipped.

A correction worth keeping wired in

• observation-webfetch-fabricated-aisvs-issue-640-pr-641-across-two-sessions — the vault twice concluded WebFetch had fabricated the #640/#641 narrative, before the 2026-07-28 audit found the opposite: the issue and PR were real, and the two-session "fabrication" verdict was a path-history artifact (checking a 1.01-dev/ path created after the April commit). Kept in this map on purpose — the tool-honesty story and the vocabulary story turned out to be the same investigation, and a false fabrication-verdict is exactly the kind of error the vault exists to catch on itself. (The general WebFetch-summary caution is now governed by sources.md §Quote provenance; that half of the 2026-07-21 flag is Cali's, not the Warden's.)

Entity hubs

• entity-norman-hardy — coined "confused deputy" (1988).
• entity-owasp-aisvs — the standard at the centre of the omission.
• entity-jim-manico · entity-joe-bollen — the merge-then-drop of requirement 9.8.8.

Adjacent, deliberately not folded in

• moc-peer-field-agent-memory covers the peer field of memory/wiki research agents and their verification discipline — a different thread that touches AI agents from the outside; this map is about the security vocabulary itself. Kept as a cross-link, not merged.

Open threads

• The false-synonym correction (TOCTOU vs lost-update) is the cluster's sharpest idea and is currently carried by a single note. If a third naming tradition for the same phenomenon-shape surfaces (e.g. optimistic-concurrency-control's "write skew"), this map wants a short observation note on why one phenomenon accreted three vocabularies rather than one.
• The Bollen/9.8.8 story ends at "dropped before release." Why it was dropped (deliberate scope decision vs editorial casualty) is unrecorded and would sharpen the "standard names none of it" claim from omission into choice.