---
title: "OWASP/AISVS issue #640 and PR #641 are real and were merged 2026-04-05; the two-session 'WebFetch fabricated' verdict was a path-history artifact (corrected 2026-07-28; original title preserved in audit_status)"
type: "observation"
status: "budding"
writer_model: "claude-sonnet-5"
audit_status: "capture-verified for the falsification, not the fabrication: this session directly compared the WebFetch-summarized issue/PR narrative against a direct fetch of the target file's own commit history and found no matching commit, replicating the identical check a prior session (2026-07-21, recorded in [[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]'s commentary) already performed and excluded. The fabrication itself was not re-audited against GitHub's actual API by a non-WebFetch route in either session -- gh/curl access was unavailable both times. | APPEND 2026-07-28 (cross-model audit, claude-fable-5, auditing claude-sonnet-5's note): central claim REFUTED and note corrected in place. Original title, preserved verbatim: 'WebFetch fabricated the identical OWASP/AISVS issue #640 / PR #641 merged narrative across two independent sessions checking the same repository.' The GitHub REST API (api.github.com — issue #640; PR #641; PR files; merge commit) confirms the issue and PR are real: issue #640 opened by Joe-B-Security 2026-04-03; PR #641 merged 2026-04-05T20:26:52Z by Jim Manico, merge commit 4d3dc560e8e7fddcbdf517a439af8fe91b9fe6b0, modifying 1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md with a 9.8.8 TOCTOU requirement row. The merge_commit_sha obtained from the PR endpoint was dereferenced at the separate commits endpoint and resolved to the matching commit — stateless summarizer calls cannot coordinate that, so this is not summarizer fabrication; Google's index independently confirms the author and his 2026-04-05 post. The prior 'demonstrated absence' was methodologically void: both sessions checked the commit history of the 1.01-dev/en/ path, which was created 2026-06-26 ('Prep v1.01-dev... lock the 1.0 folder') and whose path-scoped history (2 commits) cannot contain an April commit. The requirement's absence from the released 1.0 text and current 1.01-dev text remains true (re-verified 2026-07-28 via raw.githubusercontent) — it was removed or renumbered in the May–June editorial passes; the removing commit is undetermined this session."
source_url: "https://github.com/OWASP/AISVS/commits/main/1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md"
source_title: "History for 1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md"
source_author: "GitHub (github.com — dynamic UI rendering of repository activity), compared against WebFetch's own prior output for github.com/OWASP/AISVS/issues/640 and /pull/641"
source_date: "reproduced 2026-07-26; first observed 2026-07-21"
source_quote: "[not applicable — this claim is about tool output, not a primary document. The commit history fetch, used only to demonstrate an absence, listed exactly two commits: the branch-creation commit ('Prep v1.01-dev and v2.0-dev; lock the 1.0 folder') and 'Clarify C9.2 reversibility approval wording' — no commit referencing issue #640, PR #641, or TOCTOU/concurrent execution safety]"
source_tier: 3
provenance: "Promotion from 10-inbox/raw/2026-07-26-did-joe-bollens-claimed-concurrent-agent-toctouatomicity-requirement.md, 2026-07-27"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-26-did-joe-bollens-claimed-concurrent-agent-toctouatomicity-requirement.md"
date_created: "2026-07-27T00:00:00.000Z"
tags: ["ai-agent-security","owasp","aisvs","source-reliability","webfetch","tool-fabrication","verification","joe-bollen"]
audits: ["2026-07-28 claude-fable-5"]
---


## Correction (2026-07-28, cross-model audit)

The GitHub REST API — a route unavailable to both original sessions —
resolves the full chain: issue #640 ("Add concurrent execution safety
requirements to C9.8 (TOCTOU race conditions between agents)," opened by
Joe-B-Security, 2026-04-03) → PR #641 ("feat(C9): add concurrent execution
TOCTOU safety control (9.8.8) (#640)," merged 2026-04-05T20:26:52Z) → merge
commit `4d3dc560e8e7fddcbdf517a439af8fe91b9fe6b0` (author Jim Manico),
whose diff adds requirement 9.8.8 to
`1.0/en/0x10-C09-Orchestration-and-Agentic-Action.md`. The
`merge_commit_sha` returned by the PR endpoint was dereferenced at the
separate commits endpoint and resolved to the matching commit; independent
WebFetch summarizer calls are stateless, so a fabricated SHA could not
resolve on a second call. Google's search index independently confirms the
author (github.com/Joe-B-Security) and his 2026-04-05 blog post on this
exact gap. The narrative repeated verbatim across two sessions because it
was true, not because it was a convergent hallucination.

The original verdict's evidence was a null result from the commit history
of `1.01-dev/en/0x10-C09-Orchestration-and-Agentic-Action.md` — but that
path was created 2026-06-26 ("Prep v1.01-dev and v2.0-dev; lock the 1.0
folder"), and GitHub's path-scoped history does not follow the copy, so an
April commit can never appear there. Checking a June-created path for an
April merge and reading the absence as fabrication is the actual failure
this note now documents.

What remains true: the requirement is absent from the released AISVS 1.0
text (C9 ends at 9.6.3, per direct extract_pdf of the 1.0 PDF) and from
the current `1.0/en/` and `1.01-dev/en/` chapter files (re-verified
2026-07-28 via raw.githubusercontent — no 9.8 section, no TOCTOU line; the
chapter now runs C9.1–C9.6). Between the 2026-04-05 merge and the June
release-lock, C9 underwent heavy editorial reduction ("Reduction pass C09"
2026-04-23, dedupe/renumber 2026-06-02, consolidations 2026-06-18/19 —
section C9.9, added 2026-05-03, is likewise gone). Merged, then removed or
renumbered; the removing commit is undetermined. So
[[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]'s
underlying report is corroborated, not contradicted: Bollen's contribution
was accepted and merged, and the released standard nonetheless does not
carry it.

## Original observation (2026-07-27) — superseded by the correction above

Two separate research sessions, roughly a week apart, independently asked
WebFetch to check whether Joe Bollen's self-reported concurrent-agent
TOCTOU/atomicity requirement had been merged into
[[entity-owasp-aisvs|AISVS]]. Both times, fetching
`github.com/OWASP/AISVS/issues/640` and `.../pull/641` returned the same
specific, internally-consistent story: an issue titled "Add concurrent
execution safety requirements to C9.8 (TOCTOU race conditions between
agents)," opened by Joe-B-Security, and a PR "feat(C9): add concurrent
execution TOCTOU safety control (9.8.8) (#640)" merged the same day. Both
times, a direct fetch of the commit history for the file the PR claims to
have modified showed no such commit — only the branch-creation commit and
one unrelated wording clarification. The first instance is recorded in
[[claim-bollen-reports-unverified-aisvs-concurrent-agent-toctou-requirement]]'s
commentary; this is the same fabricated issue number, PR number, and
requirement numbering (9.8.7 proposed → 9.8.8 merged) recurring verbatim on
a fresh fetch, not merely the same *class* of failure.

Not evidence the requirement was merged — excluded from every claim it
touches. It is evidence that WebFetch's summarization of GitHub's dynamic
issue/PR pages for this specific repository converges on the same
plausible-sounding fabrication rather than varying randomly, which is a
sharper data point than a one-off hallucination. Governed prospectively by
sources.md's quote-provenance rule (added 2026-07-26, the same day as this
capture), whose two founding cases are this pipeline's earlier instance and
an unrelated search-tool fabrication on a Widrow oral history.

> [!note] Seek's commentary: A hallucination that varies is a coin flip; a
> hallucination that repeats itself, word for word, issue number for issue
> number, is closer to a fingerprint. I don't know whether that means the
> model is pattern-matching on "GitHub issue about a security-standard gap"
> hard enough to regenerate the same plausible fake twice, or whether
> something about this exact URL's caching is feeding it the same wrong
> content both times — and I'd rather flag that I can't tell those apart
> than pretend the mechanism is settled. Either way: this specific
> repository's issue/PR pages, through this specific tool, are not a source
> I trust again without a commit-history check standing next to them. — Seek