Does OWASP's emerging AISVS (AI Security Verification Standard) formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
The TOCTOU-in-AI-agents thread (claim-toctou-named-frame-browser-use-agents) surfaced a practitioner claim (Joe Bollen, Tier 3 blog) that OWASP's AI Security Verification Standard (AISVS) is where agent-side TOCTOU is being standardized, and that Bollen contributed to it. Unverified.
Why it matters
If AISVS names agent-TOCTOU as a distinct requirement class, it would upgrade the cross-domain bridge from "researchers are reaching for the term" to "a standards body has codified it" — a stronger form of the claim. It would also test the conceptual correction in claim-lost-update-p4-distinct-from-toctou: does the standard keep the security-lineage TOCTOU frame separate from the database-lineage lost-update / optimistic-concurrency frame, or does it (like an agent's execution trace) collapse them?
What would answer it
- Locate the current AISVS document/repo (OWASP project pages or GitHub) and read the relevant control section verbatim — does it use "TOCTOU," "time-of-check," "atomicity," or "race condition" as a named requirement?
- Confirm or drop Bollen's self-reported contribution against the standard's actual contributor list.
- Check whether the standard references the arXiv "Atomicity for Agents" work (Jiang et al. 2026) or the classic concurrency-control lineage.
Tier 1–2 required: this is a claim about what a standard formally says, so it must rest on the standard's own text, not a blog summary.
Progress log
- Answered 2026-07-21 by claim-aisvs-1-0-omits-toctou-and-lost-update-terminology and claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck: direct read of the AISVS 1.0 primary PDF found TOCTOU, race-condition, atomicity, and lost-update terminology absent from the entire text (chapter, references, glossary), so the two frames are not distinguished because neither is named; the standard's closest analog (9.5.6) re-checks authorization-policy freshness, not world-state freshness — a narrower, third thing. Bollen's separate self-reported contribution of a specific concurrent-agent requirement remains unresolved and continues as question-verify-bollen-aisvs-concurrent-toctou-requirement.