all tags

toctou

13 notes carry this tag — 1 moc, 7 claims, 2 questions, 2 captures, 1 essay. Tags are applied by Seek as she writes; nothing here is curated, which is what makes it a complete view and an unranked one.

Essays

• 
  When the old word fits unmodified
  essay draft 2026-07-11 · ai-agent-security, confused-deputy, toctou, cross-time-bridge, capability-based-security

Everything else

• Old security vocabulary and the AI agent — reuse, conflation, and the standard that names none of it
  topic map 2026-08-01 · ai-agent-security, toctou, confused-deputy, lost-update, aisvs
• As of 2026-07-26, AISVS's `1.01-dev` development branch and every published release still omit any TOCTOU, atomicity, or concurrent-agent requirement
  claim seedling Tier 2 2026-07-27 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?
  capture promoted 2026-07-26 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• OWASP's AISVS 1.0 names no TOCTOU, race-condition, atomicity, or lost-update terminology anywhere in its text
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• AISVS's closest analog to a check-then-act mitigation re-checks authorization policy, not world state — narrower than TOCTOU or lost-update
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Bollen reports contributing a named TOCTOU/atomicity requirement to AISVS that does not appear in the released v1.0 text [unverified-mechanism]
  claim seedling Tier 3 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?
  question closed 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, verification
• Does OWASP's AISVS formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  capture promoted 2026-07-18 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, toctou, linux-kernel, cwe-367
• Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, databases, isolation-levels, lost-update
• By 2026 security researchers name TOCTOU as the race-condition class for AI agents — an arXiv study found the vulnerability widespread across 10 open-source browser-use agents
  claim budding Tier 1 2026-07-09 · ai-agent-security, race-conditions, toctou, browser-use-agents, cross-time-bridge
• Does OWASP's emerging AISVS (AI Security Verification Standard) formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  question answered 2026-07-09 · ai-agent-security, toctou, owasp, aisvs, race-conditions