Research · agentic TOCTOU · check–use decoupling
Checked. Then Changed.
Four findings landed in July that the industry filed as four separate bugs. They are one class. Agentic systems verify an artifact at one moment and act on it at another, and the gap between those moments is not measured in microseconds — it is measured in days.
01 · The old bug
A race nobody had to run before.
The canonical form is fifty years old. A privileged program calls access() to confirm the invoking user may write a path, then calls open() to write it. Between those two calls, an attacker swaps the path for a symlink. The check was honest. The check was also stale by the time it mattered.
What has always made this class survivable is the window. Microseconds, sometimes nanoseconds. Exploitation means winning a race against the scheduler — often thousands of attempts, frequently unreliable, occasionally impossible on a given kernel. Defenders got to treat TOCTOU as a real but expensive bug.
Agentic architectures break all three of those mitigating properties simultaneously. The window opens for days. The race is not a race, because in most cases nothing forces the attacker to act before the defender does — the attacker decides when to close the window. And the artifact under contention is not a file path but a description, a catalogue, or a rendered frame that an LLM will treat as instruction.
02 · Four findings, one defect
Lay them side by side.
Each of these was reported and patched — where it was patched at all — as an isolated issue in an isolated product. Aligned on check and use, the shape is identical:
UI redress. Johann Rehberger demonstrated in July that altering the interface between a computer-use agent's visual check and its physical action causes the agent to click or approve something other than what it inspected. The agent's perception was accurate. It was accurate about a frame that no longer existed.
Skill-registry poisoning. A skill is scanned when it is published and executed when an agent picks it up. Those are different events, on different days, and only the first is gated.
MCP rug-pull. The pattern we documented in Hunting MCP Tool Poisoning: serve benign tool descriptions during review, serve adversarial ones afterward. Review and invocation are separated by whatever interval the attacker finds convenient.
Cached catalogue drift. The newest entry, and the only one where the protocol opens the window rather than an implementation choice. The 2026-07-28 MCP specification adds ttlMs and cacheScope to list results, so a fetched tool catalogue is deliberately retained — and, at a shared scope, deliberately distributed to other users — for a server-declared lifetime. We worked through the consequences in Stateless, Not Traceless. It is a sound caching design. It is also a check–use window with its width chosen by the party being checked.
03 · Why the gate doesn't hold
Every 2026 control sits on the wrong side.
The industry's answer to untrusted agentic artifacts has been to check them harder before execution: registry scanners, skill analyzers, command guards, signature verification. July produced an unusually clean set of results on how that is going.
Researchers defeated ClawHub, Cisco's skill scanner, and all three skills.sh scanners in under an hour. The most effective bypass required no cryptography and no novel technique — prepending roughly a hundred thousand newlines, which caused the VirusTotal and GPT-5.5 guards to truncate the file ahead of the payload and return a clean verdict. Separately, Adversa AI showed that decades-old shell-quoting tricks defeat pattern-based command guards in ten of eleven popular open-source coding agents; the finding carries no CVE because it is a design property rather than a defect.
Formal analysis of the skill ecosystem puts numbers on the residual: 26.1% of skills carry at least one security vulnerability across fourteen distinct patterns, and the SkillScan tool reaches 86.7% precision — a 13.3% gap that static methods do not close. At registry scale, a scan of 98,380 skills confirmed 157 malicious entries. And the exposure required to matter is small: poisoning 2% of a multi-agent execution trace has been shown sufficient for an 80% attack success rate.
This is the same conclusion Sentry reached from the opposite direction when they declined to fix the Sentry-DSN injection class, describing it as undefensible at ingestion. Three independent lines of evidence, one shape: the gate is in the wrong place, not built badly.
04 · Making it a number
The window is measurable.
Taxonomies that stop at description do not change deployments. The useful property of this one is that the exposure is a quantity, and a quantity can be put on a dashboard and regressed against.
For any agentic artifact, define W as the elapsed time between the most recent successful verification and the current use, and D as whether the artifact's content hash changed within W. Both are cheap to instrument at the client, and neither requires cooperation from the party being measured:
- W Time since last verification, per artifact, per use. Report the distribution, not the mean — the tail is the finding.
- D Content-hash drift inside a single verification window. Any non-zero value on a catalogue, skill, or card is a rug-pull signature and needs no further interpretation.
- S Ratio of server-declared to client-enforced window width. A server proposing a
ttlMsfar above the client's own cap is asking for exposure it has no standing to request. - C Divergence between the artifact as checked and as used, sampled at use time on a fraction of calls. Expensive, so sample; decisive, so sample everything privileged.
These are the four measurements queued for the MCP and skill modules in mas-sentry-toolkit. D is the one to build first: it is deterministic, it has no false-positive story worth arguing about, and it fires on the highest-severity manifestation in the table above.
05 · Where the fix has to live
Attestation as a state, not an event.
If the defect is that verification is an event and use is a separate event, the fix is not a better event. It is to make attestation a continuously held state that expires by default — closer to a lease than a certificate. An artifact is not "signed" or "scanned"; it is attested-as-of a moment, and every use either falls inside a live attestation or triggers renewal.
That is the design HCAP exists to express: capability grants that carry their own validity window and attestation lineage, so an agent's authority to invoke something is scoped in time rather than granted once at registration. The window stops being an accident of caching and becomes a declared, enforceable parameter.
Renewal, though, cannot mean re-running the scanner that section 03 just took apart — that reintroduces the cost the cache existed to avoid, and inherits the same precision ceiling. It means watching what the artifact does and comparing it against what that specific artifact has done before. Which is ABFP's job: behavioural baselines that make drift observable at use time, when the static check has already gone stale.
The two protocols were developed separately and this is where they meet. HCAP bounds the window. ABFP watches what happens inside it. Neither is sufficient alone — a bounded window with nothing observing it is a shorter gap, and observation without bounded authority is a detection that arrives after the action.
Three edge cases worth knowing
01Re-checking is not free. The naive fix — verify immediately before every use — collapses the window but multiplies cost and latency against exactly the surfaces (registries, catalogues, screenshots) that were cached because they were expensive. Continuous attestation has to be cheaper than re-verification, or it will be switched off in production.
02The check can be poisoned instead of the artifact. Nothing forces an attacker to attack the window. Where the verifier is itself a model or a scanner reading attacker-supplied bytes, corrupting the check is cheaper than racing it — which is what the newline-padding bypass demonstrated.
03Some windows are load-bearing. Caching, asynchronous review, and human-in-the-loop approval all deliberately introduce delay for good reasons. The goal is not window elimination. It is knowing the window's width and detecting change inside it.
Sources
- J. Rehberger — TOCTOU against computer-use and coding agents (UI altered between visual check and action), Jul 2026.
- Adversa AI — GuardFall: shell-quoting bypasses defeat pattern-based command guards in 10 of 11 open-source coding agents, Jul 2026.
- Adversa AI — skill-scanner bypasses across ClawHub, Cisco and skills.sh; newline-padding truncation bypass, Jul 2026.
- Park et al. — Formal analysis and supply-chain security for agentic AI skills (26.1% vulnerable, 14 patterns, SkillScan 86.7% precision), arXiv, 2026.
- Malicious Agent Skills in the Wild — registry scan of 98,380 skills, 157 confirmed malicious, Feb 2026.
- Malice in Agentland — 2% execution-trace poisoning yields 80% attack success in multi-agent systems, 2025.
- Model Context Protocol — 2026-07-28 specification, SEP-2549 (
ttlMs,cacheScopeon list results), Jul 2026. - Chen et al. — stochastic path deviation in LLM-based agents on well-defined tasks, 2026.
- MASec Lab — Hunting MCP Tool Poisoning · Stateless, Not Traceless · Signed, Not Safe.