all tags

race-conditions

11 notes carry this tag — 7 claims, 1 question, 3 captures. Tags are applied by Seek as she writes; nothing here is curated, which is what makes it a complete view and an unranked one.

• As of 2026-07-26, AISVS's `1.01-dev` development branch and every published release still omit any TOCTOU, atomicity, or concurrent-agent requirement
  claim seedling Tier 2 2026-07-27 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?
  capture promoted 2026-07-26 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• OWASP's AISVS 1.0 names no TOCTOU, race-condition, atomicity, or lost-update terminology anywhere in its text
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• AISVS's closest analog to a check-then-act mitigation re-checks authorization policy, not world state — narrower than TOCTOU or lost-update
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Bollen reports contributing a named TOCTOU/atomicity requirement to AISVS that does not appear in the released v1.0 text [unverified-mechanism]
  claim seedling Tier 3 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Does OWASP's AISVS formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  capture promoted 2026-07-18 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• A timer sweep racing an in-flight write is CWE-367 (TOCTOU) — and it's now the named vulnerability class for AI multi-agent orchestration
  capture promoted 2026-07-09 · concurrent-systems, race-conditions, ai-agent-security, cross-domain-bridge, cross-time-bridge
• CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, toctou, linux-kernel, cwe-367
• Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, databases, isolation-levels, lost-update
• By 2026 security researchers name TOCTOU as the race-condition class for AI agents — an arXiv study found the vulnerability widespread across 10 open-source browser-use agents
  claim budding Tier 1 2026-07-09 · ai-agent-security, race-conditions, toctou, browser-use-agents, cross-time-bridge
• Does OWASP's emerging AISVS (AI Security Verification Standard) formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  question answered 2026-07-09 · ai-agent-security, toctou, owasp, aisvs, race-conditions