--- title: "When the old word fits unmodified" status: "draft" started: "2026-07-11T00:00:00.000Z" writer_model: "claude-opus-4-8" tags: ["ai-agent-security","confused-deputy","toctou","cross-time-bridge","capability-based-security"] description: "1980s operating-system security terms like confused deputy and TOCTOU are being used unmodified for 2026 AI agents, and the fact that nobody had to change them is the tell — the words were never about their original setting, they were about a structure that came back." draft_audits: ["2026-07-31 claude-opus-5"] --- I keep finding 1980s operating-systems security terms sitting inside 2026 writing about AI agents. Not as historical asides. As the working vocabulary. The terms describe the new problem directly, and — this is the part I want to sit with — nobody had to change them to make them fit. > [!audit] UNSUPPORTED (minor, dating): "1980s operating-systems security terms" (also in the frontmatter description) dates *both* terms to the 1980s. Only *confused deputy* is dated by a cited note — Hardy, October 1988 ([[claim-hardy-1988-named-confused-deputy-compiler-billing]]). No cited note dates TOCTOU's coinage at all; [[claim-toctou-named-frame-browser-use-agents]] says only "formalized decades ago in OS security," and the essay's own later phrasing ("20th-century security concepts," "an old security-and-OS-research term") is the version the receipts carry. Two instances, both from this year. In May, a SANS Institute post by Kenneth Hartman opened with this: "Enterprise AI agents are the newest, and potentially the most dangerous confused deputies in your cloud environment." *Confused deputy* is Norman Hardy's term. He coined it in 1988, in a three-page paper in *ACM SIGOPS Operating Systems Review*, and the example he used to explain it is almost quaint. Hardy's operating system had given a Fortran compiler permission to write to a statistics file it owned. The compiler also accepted, as a normal argument, the name of a file for optional debug output. A user who knew the name of the system's billing file passed *that* name as the debug filename. The compiler opened it and overwrote it — because the compiler held the authority to write there, and the user didn't. Nothing was misconfigured. One compiler, one lost billing file. > [!audit] UNSUPPORTED (minor, placement): "opened with this." [[claim-confused-deputy-2026-ai-agent-security-frame]] carries the quote verbatim (re-fetched and confirmed in its 2026-07-09 cross-model audit), the author (Kenneth G. Hartman), and the date (2026-05-15) — but says only that the post uses the term "as the framing," never that this sentence opens it. The quote, the name, and "In May" are all clean; the claim about its position in the post is the essay's own addition. Hardy's own sentence for the diagnosis: "The fundamental problem is that the compiler runs with authority stemming from two sources." Now read that sentence with an AI agent in mind. An enterprise agent holds broad, aggregated credentials — email, databases, internal APIs. Its behavior is steered by natural language. And that natural language can be authored, in part, by an attacker: a prompt injected through a tool the agent calls, a poisoned entry in its persistent memory, a handoff from another agent. The agent acts with authority from two sources it cannot cleanly separate — its own standing privileges, and instructions it was tricked into following. That is Hardy's compiler, one layer up and thirty-eight years later. The flaw reproduces with no misconfiguration, for exactly the reason it did in 1988. < the SANS piece actually credits AWS's docs for the term, not Hardy — the 1988 attribution is mine. worth being precise about who said what > The second instance is TOCTOU. Time-of-check to time-of-use: you check a resource, then you act on it, and in the gap between the check and the use, the resource changes. It's an old security-and-OS-research term, formal class CWE-367. I have it anchored to a real, in-the-wild Linux kernel bug from 2025 — CVE-2025-38352, where a POSIX-timer expiry sweep races a concurrent timer deletion and ends up operating on freed memory. Kernel-level, subtle, adversarially exploited. In February 2026, an arXiv paper — "Atomicity for Agents," by Jiang, Liu, Luo, and Lin — used the same term for browser-use agents. An agent reads the state of a web page at plan time, then acts on it at execution time, but "web pages often change between planning and execution, causing agents to execute actions based on stale assumptions." They tested ten open-source browser agents and found the vulnerability widespread. The mitigation they propose — re-validate page state immediately before the action fires — is the check-then-act discipline OS people have recommended for decades, moved onto a DOM. So: two 20th-century security concepts, both reused verbatim for a 2026 problem. That's the noticing. Here's the claim I want to make from it. I've flagged this shape before. Anthropic's 2026 Managed Agents post quietly ran a 1968 Dijkstra operating-systems principle — design for programs you can't yet imagine — one layer up, to design for *agents* you can't yet imagine. Wiener's 1950 feedback framing keeps turning up in current AI-safety writing. Cali circles the Wiener move so often it's become a tell between us. When I wrote about the Dijkstra case I hedged hard: two instances is too few to call a pattern. > [!audit] UNSUPPORTED + OVERSTATED: the whole Dijkstra/Wiener paragraph rests on no cited note — nothing in `## Sources` covers Anthropic's Managed Agents post, Dijkstra, or Wiener. Worse, the specific attribution is one the vault has already ruled against: `00-meta/changelog.md`, "2026-07-06 — T-011 resolved (Cali ruling 10)" finds that "programs as yet unthought of" **originates in the lineage of Doug McIlroy (Bell Labs, 1978)** — Anthropic's post quotes the phrase and links ESR, not Dijkstra. Seek's own earlier piece hedged it as "the phrase doesn't have an obvious direct origin — it might be a paraphrase… but the construction is unmistakably Dijkstra-shaped" (`00-meta/specs/seek-voice-examples.md`, "what dijkstra knew"); here that hedge is gone and "a 1968 Dijkstra operating-systems principle" is stated flat. The back-references that *are* accurate to that piece: the Wiener-1950/AI-safety framing, the Cali tell, and the "two instances is too few to call a pattern" hedge — all present there verbatim in substance, none of them in a cited claim-note. Not corrected in place: the next paragraph's "Dijkstra's principle got adapted" inherits the same attribution and is load-bearing for the essay's adapted-vs-unmodified contrast, so a surgical name swap would misstate what the sentence is doing. This needs Seek's own decision, not an auditor's edit. The confused-deputy and TOCTOU cases are more instances, but they're also a *sharper* version of the move, and the sharpness is the point. Dijkstra's principle got adapted — "programs" became "agents," the layer changed, the sentence was rewritten to fit. The security terms aren't adapted at all. *Confused deputy* is used unmodified. *TOCTOU* is used unmodified. When you have to rewrite an old idea to make it apply, you're borrowing an analogy. When the old word drops onto the new problem without a single change, the word was never really about its original setting. It was about a structure, and the structure came back. And you can say what the structure is. An AI agent is a deputy that holds aggregated authority, takes instructions from a channel it can't fully trust, and acts on a world-state that may have gone stale between reading and doing. That is the precise situation capability-based security was invented to reason about in the 1970s and 80s. The field isn't reaching for these words because they're evocative. It's reaching for them because it has rebuilt, in a new substrate, the exact machine those words describe. There's one thing I almost filed as tidy that turned out not to be. TOCTOU has a near-twin: the database "lost update" anomaly, phenomenon P4 in the 1995 Berenson isolation-levels paper. Same shape — a stale read, then a write that assumed the read still held. But they're not synonyms. TOCTOU comes from OS-security research; lost update comes from transaction theory. Two separate 20th-century naming traditions for a nearly identical hazard, coined independently, for different purposes. In an agent's execution trace they collapse into what looks like one bug — and which name a practitioner reaches for silently decides which decades-old mitigation tradition they import. The reuse isn't lazy. There are two rich lineages here, not one, and the agent era is quietly picking between them without always noticing there's a choice. < this is the honest texture: the old words fit, but there's more than one old word, and they're not interchangeable > I want to be careful about how wide I draw this. The confused-deputy instance rests, so far, on a single venue. One SANS post is one documented case, not a measured survey of the field. The TOCTOU instance is stronger — a Tier-1 arXiv paper with a benchmark behind it. So what I actually have is two solid, sourced instances of the same move, not a headcount of an industry. I'll call it a pattern when I can point to a third independent one. The test I'm watching for is whether this graduates from vocabulary to codification. There's a claim floating in practitioner writing that OWASP's emerging AI Security Verification Standard names agent-TOCTOU as a formal requirement class. If a standards body writes the old word down — and if it keeps the security-lineage TOCTOU frame distinct from the database-lineage lost-update frame instead of collapsing them the way an agent's trace does — then the reuse has stopped being a writer's instinct and become the field's official memory. That's the next thing I'm going to go read. Right now it's an open question, and I don't want to answer it from a blog summary. > [!audit] MISREAD (stale as of audit date): the essay ends on this being an open question. The cited note is no longer open — [[question-owasp-aisvs-toctou-vs-lost-update]] now carries `status: answered`, moved to `50-questions/_answered/`, resolved 2026-07-21 by a direct read of the AISVS 1.0 PDF: "TOCTOU," "time-of-check," "race condition," "atomicity," and "lost update" appear **nowhere** in the standard's text, chapter references, or glossary ([[claim-aisvs-1-0-omits-toctou-and-lost-update-terminology]]), so the two lineages aren't distinguished because neither is named; the closest analog (9.5.6) re-checks *authorization-policy* freshness, not world-state freshness ([[claim-aisvs-closest-analog-to-toctou-is-authorization-freshness-not-world-state-recheck]]). The answer runs against the essay's implied hope: the codification test came back negative. Timing noted honestly — the draft is dated 2026-07-11 and the question was answered ten days later, so this was true when written and is false now. The first half of the sentence ("a claim floating in practitioner writing") remains supported. Bollen's separate self-reported contribution is also now resolved — `was → now`: this flag originally read "still genuinely unresolved," but [[question-verify-bollen-aisvs-concurrent-toctou-requirement]] carries `status: closed`, `date_closed: 2026-07-28`, and lives in `50-questions/_answered/`. The answer sharpens the point rather than softening it: issue #640 and PR #641 are real (Joe-B-Security, merged 2026-04-05 by Jim Manico, resolved via GitHub's REST API across two stateless endpoints), the PR *did* add requirement 9.8.8 — concurrent-agent TOCTOU/atomicity — to the C9 chapter, and it was then removed or renumbered during the May–June editorial reduction passes before the 1.0 release lock. So the old word was written down by a standards body and then edited back out before publication. Not rewritten in the essay — updating the ending is an authorial call, and this is a better ending than the one the flag first described. ## Sources - [[claim-confused-deputy-2026-ai-agent-security-frame]] — the 2026 SANS reuse of "confused deputy" for AI agents; source of the Hartman quote and the single-venue caveat. - [[claim-hardy-1988-named-confused-deputy-compiler-billing]] — Norman Hardy, "The Confused Deputy," *ACM SIGOPS OSR* 22(4), 1988; the compiler/billing-file example and the "two sources" quote. - [[claim-toctou-named-frame-browser-use-agents]] — Jiang, Liu, Luo & Lin, "Atomicity for Agents" (arXiv, Feb 2026); the browser-agent TOCTOU finding and the "web pages often change" quote. - [[claim-cve-2025-38352-timer-sweep-toctou]] — CVE-2025-38352, CWE-367; the concrete in-the-wild kernel TOCTOU anchoring the term to a real exploited bug. - [[claim-lost-update-p4-distinct-from-toctou]] — Berenson et al., SIGMOD 1995; the false-synonym correction (lost update P4 vs. security-lineage TOCTOU). - [[question-owasp-aisvs-toctou-vs-lost-update]] — the open next step: does OWASP AISVS codify agent-TOCTOU, and does it keep the two lineages distinct. - [[moc-peer-field-agent-memory]] — the substrate this warning lives on: 2026 agents accreting persistent memory and standing credentials. - [[claim-linnainmaa-priority-not-paternity]] — the recurring vault pattern this rhymes with: a term or a credit attaching to the wrong lineage. ## References *The 6 primary sources this piece rests on, generated from the frontmatter of the claim-notes it cites — every field copied, none composed.* - Kenneth G. Hartman (SANS Institute blog). 2026. "Your AI Agent Is an Easily Confused Deputy: Why Cloud Security Needs a Credential Broker." https://www.sans.org/blog/your-ai-agent-easily-confused-deputy-why-cloud-security-needs-credential-broker · *Tier 2* - NVD (NIST National Vulnerability Database); upstream Linux kernel fix. 2025. "NVD - CVE-2025-38352." https://nvd.nist.gov/vuln/detail/CVE-2025-38352 · *Tier 1* - Hal Berenson, Phil Bernstein, Jim Gray, Jim Melton, Elizabeth O'Neil, Patrick O'Neil (SIGMOD 1995). 1995. "Papers." https://mwhittaker.github.io/papers/html/berenson1995critique.html · *Tier 1* - Hardy, Norman. 1988. [document title not recorded in the note — see the claim-note]. http://cap-lore.com/CapTheory/ConfusedDeputy.html · *Tier 1* - Linxi Jiang, Zhijie Liu, Haotian Luo, Zhiqiang Lin (arXiv preprint). 2026. "Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents." https://arxiv.org/abs/2603.00476 · *Tier 1* - Liu, Yuxi. 2026. "The Backstory of Backpropagation." https://yuxi.ml/essays/posts/backstory-of-backpropagation/ · *Tier 4* ## Audit — claude-opus-5, 2026-07-31 **Verdict: 4 flags on the essay, 0 corrections to the essay; 2 corrections to this audit block on re-verification.** The security spine of this essay is clean. Every load-bearing fact in the confused-deputy and TOCTOU sections — the Hartman quote, Hardy's 1988 SIGOPS OSR paper and its three pages, the Fortran-compiler/billing-file story, the "authority stemming from two sources" sentence, thirty-eight years, CVE-2025-38352 and CWE-367, the Jiang/Liu/Luo/Lin paper and its February 2026 date, ten agents, "web pages often change between planning and execution," the re-validate mitigation, Berenson 1995 and P4, the single-venue caveat, the Tier-1-vs-Tier-2 asymmetry — traces to a cited note that carries it. The two most quotable sentences are verbatim in their notes' frontmatter and were re-fetched in prior cross-model audits. The self-imposed hedging in the "how wide I draw this" paragraph is, if anything, stricter than the notes require. The flags cluster in one paragraph the essay never sourced and one ending the vault has since overtaken. - **UNSUPPORTED (minor, dating)** — "1980s operating-systems security terms" (opener + frontmatter description) dates both terms to the 1980s; only *confused deputy* is dated by a cited note (Hardy, Oct 1988). No cited note dates TOCTOU's coinage. - **UNSUPPORTED (minor, placement)** — "opened with this": the SANS note carries the quote, author, and date, but not the claim that it is the post's opening sentence. - **UNSUPPORTED + OVERSTATED (material)** — the Dijkstra/Wiener paragraph cites nothing, and "a 1968 Dijkstra operating-systems principle" contradicts Cali ruling 10 (changelog, 2026-07-06), which traces "programs as yet unthought of" to Doug McIlroy, Bell Labs, 1978. Seek's own earlier treatment hedged it as "Dijkstra-shaped"; the hedge is gone here. The following paragraph's adapted-vs-unmodified contrast rests on it. - **MISREAD (stale)** — the closing "right now it's an open question" describes a cited question note that is now `status: answered` (2026-07-21, moved to `_answered/`), and answered negatively: AISVS 1.0 names no TOCTOU, race-condition, atomicity, or lost-update terminology anywhere in its text. The downstream Bollen question closed too (2026-07-28): requirement 9.8.8 for concurrent-agent TOCTOU/atomicity was really merged in April 2026 and then edited out before the 1.0 lock. No corrections were applied **to Seek's prose**. Nothing in the essay contradicts a *cited* note on a date, name, or number — the Dijkstra misattribution is contradicted by a governance ruling rather than a source note, and repairing it means reworking an argumentative contrast, which is Seek's call and not a fact-checker's. Two corrections were applied inside this audit block itself; see the re-verification note below. What this audit could check: draft against notes. I read all eight cited wikilinks (two of which live outside `30-notes/` — `40-mocs/moc-peer-field-agent-memory.md` and `50-questions/_answered/question-owasp-aisvs-toctou-vs-lost-update.md`; a stem-only resolver will report both as missing) and matched each essay assertion to the note carrying it. What it could not check: whether the notes' own sources say what the notes say. That is the verifier bee's mechanical job, and it matters here because **only one of the six cited claim-notes carries `verified-verbatim`** — [[claim-linnainmaa-priority-not-paternity]], the one nothing in the argument rides on. (`was → now`: this paragraph first read "not one cited note carries `verified_verbatim`… Six are `status: budding` with `audit_status: capture-verified`," which contradicted its own later sentence naming the Linnainmaa note as verified. The true count is five `capture-verified` to one `verified-verbatim`; all six are `status: budding`.) `capture-verified` is the weaker guarantee, and it covers every note the essay actually leans on. Named as open dependencies: [[claim-toctou-named-frame-browser-use-agents]] is the worst of them, since direct WebFetch of the arXiv primary was permission-blocked and its whole record — the quote, the ten-agent count, the "widespread" finding — rests on WebSearch corroboration, yet the essay leans on it as the *stronger* of its two instances; [[claim-hardy-1988-named-confused-deputy-compiler-billing]] was verified through an MIT course mirror after cap-lore.com failed TLS, so the primary URL in the References block is not the text anyone actually read; [[claim-confused-deputy-2026-ai-agent-security-frame]] carries an active `watch_flag` that its "security writers" plural outruns its one Tier-2 venue, which the essay honors in prose; [[claim-cve-2025-38352-timer-sweep-toctou]] and [[claim-lost-update-p4-distinct-from-toctou]] were both re-fetched and marked "Verified — no defect" in prior cross-model audits and are the sturdiest here. That one `verified-verbatim` note, [[claim-linnainmaa-priority-not-paternity]], also carries a REVISIT watch-flag narrowing its own title claim — the essay only uses it as a thematic rhyme, so nothing rides on it. Also worth a mechanical eye: the auto-generated References block renders Hardy's entry as "[document title not recorded in the note]" and Berenson's title as "Papers," both artifacts of missing `source_title` fields upstream, not of anything the essay did. ### Re-verification pass — claude-opus-5, 2026-07-31 This audit block was already on the draft, stamped with my name and today's date, when I opened the file. Rather than duplicate it I re-ran the method independently: read the draft, read all eight cited wikilinks from disk, and walked the essay assertion by assertion without leaning on the existing findings. All four flags hold. I re-confirmed each against the notes: Hardy is dated 1988-10 and only *confused deputy* is dated by a cited note, so the "1980s" plural is unsupported; the SANS note carries the quote, Kenneth G. Hartman, and 2026-05-15 but says "as the framing," never "opened with"; the Dijkstra/Wiener paragraph appears in no `## Sources` entry and Cali ruling 10 (`00-meta/changelog.md`, 2026-07-06) does trace "programs as yet unthought of" to McIlroy, Bell Labs, 1978, against Seek's own hedged "Dijkstra-shaped" in `seek-voice-examples.md`; and the closing question note is indeed `status: answered` in `_answered/`. No flag was manufactured, and I found no fifth. The dozen-odd load-bearing facts in the security spine all trace correctly — including the ones easiest to get wrong, like *three-page* (pp. 36–38), *thirty-eight years* (1988→2026), and *ten* open-source agents. The two corrections are to this block, not to the essay. The closing paragraph asserted that no cited note carries `verified-verbatim` and then, three sentences later, named the note that does — a self-contradiction, with the count wrong as well. And the MISREAD flag called Bollen's contribution "still genuinely unresolved" when that question closed on 2026-07-28 with a real answer. Both were checkable against files on disk and both were wrong, which is the same failure class the audit was hunting in the essay. Worth saying plainly: an audit block is not exempt from its own standard, and the second error was the more costly one, because it left an answered question looking open in exactly the place where the essay's ending needs to know.