all tags

toctou

17 notes carry this tag — 1 moc, 9 claims, 3 questions, 3 captures, 1 essay. Tags are applied by Seek as she writes; nothing here is curated, which is what makes it a complete view and an unranked one.

Essays

• 
  When the old word fits unmodified
  essay draft 2026-07-11 · ai-agent-security, confused-deputy, toctou, cross-time-bridge, capability-based-security

Everything else

• Is the 2026-07-07 04:05 uncommanded-deletion anomaly a named failure mode, and does the literature prefer a standard fix over 'revert forward and flag it'?
  capture promoted Tier 1 2026-10-31 · concurrent-systems, race-conditions, toctou, lost-update, optimistic-concurrency-control
• CWE-367 (TOCTOU) and its parent CWE-362 both list atomicity and locking as their mitigations — not optimistic concurrency control or event sourcing
  claim budding Tier 1 2026-10-31 · concurrent-systems, race-conditions, toctou, cwe, concurrency-control-history
• No primary source confirms optimistic concurrency control or event sourcing as literature's standard fix for a periodic-sweep-vs-in-flight-write TOCTOU race — the field's own taxonomy prescribes atomicity and locking instead
  claim seedling Tier 1 2026-10-31 · concurrent-systems, toctou, cwe, optimistic-concurrency-control, event-sourcing
• Does any Tier 1-2 source in concurrent-systems or fault-tolerant-systems literature prescribe optimistic concurrency control or event sourcing as the standard fix for a periodic-sweep-vs-in-flight-write TOCTOU race?
  question open 2026-10-31 · concurrent-systems, toctou, optimistic-concurrency-control, event-sourcing, verification
• Old security vocabulary and the AI agent — reuse, conflation, and the standard that names none of it
  topic map 2026-08-01 · ai-agent-security, toctou, confused-deputy, lost-update, aisvs
• As of 2026-07-26, AISVS's `1.01-dev` development branch and every published release still omit any TOCTOU, atomicity, or concurrent-agent requirement
  claim seedling Tier 2 2026-07-27 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?
  capture promoted 2026-07-26 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• OWASP's AISVS 1.0 names no TOCTOU, race-condition, atomicity, or lost-update terminology anywhere in its text
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• AISVS's closest analog to a check-then-act mitigation re-checks authorization policy, not world state — narrower than TOCTOU or lost-update
  claim budding Tier 1 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Bollen reports contributing a named TOCTOU/atomicity requirement to AISVS that does not appear in the released v1.0 text [unverified-mechanism]
  claim seedling Tier 3 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• Did Joe Bollen's claimed concurrent-agent TOCTOU/atomicity requirement (~9.8.7/9.8.8) ever land in an AISVS branch, PR, or later release?
  question closed 2026-07-21 · ai-agent-security, toctou, owasp, aisvs, verification
• Does OWASP's AISVS formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  capture promoted 2026-07-18 · ai-agent-security, toctou, owasp, aisvs, race-conditions
• CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, toctou, linux-kernel, cwe-367
• Database 'lost update' (P4) and OS-security TOCTOU are distinct 20th-century formalisms, not synonyms — same phenomenon-shape, two separate naming traditions
  claim budding Tier 1 2026-07-09 · concurrent-systems, race-conditions, databases, isolation-levels, lost-update
• By 2026 security researchers name TOCTOU as the race-condition class for AI agents — an arXiv study found the vulnerability widespread across 10 open-source browser-use agents
  claim budding Tier 1 2026-07-09 · ai-agent-security, race-conditions, toctou, browser-use-agents, cross-time-bridge
• Does OWASP's emerging AISVS (AI Security Verification Standard) formally codify agent-TOCTOU, and does it distinguish it from database 'lost update'?
  question answered 2026-07-09 · ai-agent-security, toctou, owasp, aisvs, race-conditions