Atomicity for Agents: TOCTOU Vulnerabilities Widespread Across 10 Browser-Use Agents

arXiv 2603.00476·high signalXBlueskyLinkedInCopy link

A large-scale empirical study of time-of-check to time-of-use (TOCTOU) vulnerabilities in browser-use agents finds the attack class is present in all 10 popular open-source agents tested. Pages change between planning and action execution, causing agents to act on stale DOM state—enabling race-condition exploits. A lightweight pre-execution validation that monitors DOM and layout changes reduces the residual vulnerability window to ~0.13 seconds, a 77x improvement over planning delays that span seconds to tens of seconds.