mlsanityData to 7 Oct 2026

Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents

arXiv 2603.00476 ↗First posted 28 Feb 2026cs.CR cs.AIcited by 6

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Browser-use agents are widely used for everyday tasks. They enable automated interaction with web pages through structured DOM based interfaces or vision language models operating on page screenshots. However, web pages often change between planning and execution, causing agents to execute actions based on stale assumptions. We view this temporal mismatch as a time of check to time of use (TOCTOU) vulnerability in browser-use agents. Dynamic or adversarial web content can exploit this window to induce unintended actions. We present a large scale empirical study of TOCTOU vulnerabilities in browser-use agents using a benchmark that spans synthesized and real world websites. Using this benchmark, we evaluate 10 popular open source agents and show that TOCTOU vulnerabilities are widespread. We design a lightweight mitigation based on pre-execution validation. It monitors DOM and layout changes during planning and validates the page state immediately before action execution. This approach reduces the risk of insecure execution and mitigates unintended side effects in browser-use agents.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 19 of its 35 references that are in the map. First posted on arXiv 28 Feb 2026.

Builds on

19 of 35 references.

Closest ancestors · 6

Same direction, newest first

  1. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents9 Sep
  2. 2025A Systematization of Security Vulnerabilities in Computer Use Agents7 Jul
  3. 2025RedTeamCUA: Realistic Adversarial Testing of Computer-Use Agents in Hybrid Web-OS Environments28 May
  4. 2024Attacking Vision-Language Computer Agents via Pop-ups4 Nov
  5. 2024Breaking ReAct Agents: Foot-in-the-Door Attack Will Get You In22 Oct
  6. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakage17 Sep

Other references · 13

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  3. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  4. 2023Mind2Web: Towards a Generalist Agent for the Webcited by 1,210
  5. 2022WebShop: Towards Scalable Real-World Web Interaction with Grounded Language Agentscited by 1,197
  6. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  7. 2025UI-TARS: Pioneering Automated GUI Interaction with Native Agentscited by 584
  8. 2024WebVoyager: Building an End-to-End Web Agent with Large Multimodal Modelscited by 424
  9. 2024Agent S: An Open Agentic Framework that Uses Computers Like a Humancited by 182
  10. 2025A Survey of WebAgents: Towards Next-Generation AI Agents for Web Automation with Large Foundation Modelscited by 87
  11. 2024Agent-E: From Autonomous Web Navigation to Foundational Design Principles in Agentic Systemscited by 79
  12. 2025Mind2Web 2: Evaluating Agentic Search with Agent-as-a-Judgecited by 75
1 more
  1. 2025A Survey on (M)LLM-Based GUI Agentscited by 61

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 6.

6 papers.

  1. 2026Temporary Authority, Permanent Effects: Commit-Time Authorization for LLM Agentscited by 17
  2. 2026Stop Means Stop: Measuring and Repairing the Enforcement Gap in Agent-Framework Control Primitivescited by 3
  3. 2026Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agentscited by 0
  4. 2026The Balkanization of Execution-Security Research for AI Coding Agents: Isolation, Access Control, and Time-of-Check-to-Time-of-Use Vulnerabilitiescited by 0
  5. 2026Approved Too Late: Verdict Staleness in LLM-Guarded Self-Adaptive Systemscited by 0
  6. 2026Janus: Evidence-Before-Effect Sagas and Offline-Verifiable Provenance for Agentic LLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Building Browser Agents: Architecture, Security, and Practical Solutions
  2. 2025The Hidden Dangers of Browsing AI Agents
  3. 2025Context manipulation attacks : Web agents are susceptible to corrupted memory
  4. 2025BrowseSafe: Understanding and Preventing Prompt Injection Within AI Browser Agents
  5. 2026CAP: A Scalable Benchmark for Evaluating Cross-Site Browser Agents with Complex Actions and Perception
  6. 2026WAAA! Web Adversaries Against Agentic Browsers
  7. 2026Wuying-Browser-Agent: Real-World Centric Fundamental Long-Horizon Browser Agents
  8. 2025WebGuard: Building a Generalizable Guardrail for Web Agents