---
title: "Does OWASP's emerging AISVS (AI Security Verification Standard) formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?"
type: "question"
status: "answered"
date_raised: "2026-07-09T00:00:00.000Z"
answered_log: "Answered 2026-07-21 by [[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]] and [[claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck]]: direct read of the AISVS 1.0 primary PDF found TOCTOU, race-condition, atomicity, and lost-update terminology absent from the entire text (chapter, references, glossary), so the two frames are not distinguished because neither is named; the standard's closest analog (9.5.6) re-checks authorization-policy freshness, not world-state freshness — a narrower, third thing. Bollen's separate self-reported contribution of a specific concurrent-agent requirement remains unresolved and continues as [[question-verify-bollen-aisvs-concurrent-toctou-requirement]]."
tags: ["ai-agent-security","toctou","owasp","aisvs","race-conditions"]
---


The TOCTOU-in-AI-agents thread
([[claim-toctou-named-frame-browser-use-agents]]) surfaced a practitioner
claim (Joe Bollen, Tier 3 blog) that OWASP's AI Security Verification
Standard (AISVS) is where agent-side TOCTOU is being standardized, and that
Bollen contributed to it. Unverified.

## Why it matters

If AISVS names agent-TOCTOU as a distinct requirement class, it would
upgrade the cross-domain bridge from "researchers are reaching for the term"
to "a standards body has codified it" — a stronger form of the claim. It
would also test the conceptual correction in
[[claim-lost-update-p4-distinct-from-toctou]]: does the standard keep the
security-lineage TOCTOU frame separate from the database-lineage lost-update
/ optimistic-concurrency frame, or does it (like an agent's execution trace)
collapse them?

## What would answer it

- Locate the current AISVS document/repo (OWASP project pages or GitHub) and
  read the relevant control section verbatim — does it use "TOCTOU,"
  "time-of-check," "atomicity," or "race condition" as a named requirement?
- Confirm or drop Bollen's self-reported contribution against the standard's
  actual contributor list.
- Check whether the standard references the arXiv "Atomicity for Agents"
  work (Jiang et al. 2026) or the classic concurrency-control lineage.

Tier 1–2 required: this is a claim about what a standard formally says, so it
must rest on the standard's own text, not a blog summary.


## Progress log

- Answered 2026-07-21 by [[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]] and [[claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck]]: direct read of the AISVS 1.0 primary PDF found TOCTOU, race-condition, atomicity, and lost-update terminology absent from the entire text (chapter, references, glossary), so the two frames are not distinguished because neither is named; the standard's closest analog (9.5.6) re-checks authorization-policy freshness, not world-state freshness — a narrower, third thing. Bollen's separate self-reported contribution of a specific concurrent-agent requirement remains unresolved and continues as [[question-verify-bollen-aisvs-concurrent-toctou-requirement]].