Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents

Linxi Jiang; Zhijie Liu; Haotian Luo; Zhiqiang Lin

cs.CRFeb 28, 2026

Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents

Authors: Linxi Jiang, Zhijie Liu, Haotian Luo, Zhiqiang Lin

Organizations: The Ohio State University

Abstract

Browser-use agents are widely used for everyday tasks. They enable automated interaction with web pages through structured DOM based interfaces or vision language models operating on page screenshots. However, web pages often change between planning and execution, causing agents to execute actions based on stale assumptions. We view this temporal mismatch as a time of check to time of use (TOCTOU) vulnerability in browser-use agents. Dynamic or adversarial web content can exploit this window to induce unintended actions. We present a large scale empirical study of TOCTOU vulnerabilities in browser-use agents using a benchmark that spans synthesized and real world websites. Using this benchmark, we evaluate 10 popular open source agents and show that TOCTOU vulnerabilities are widespread. We design a lightweight mitigation based on pre-execution validation. It monitors DOM and layout changes during planning and validates the page state immediately before action execution. This approach reduces the risk of insecure execution and mitigates unintended side effects in browser-use agents.

Figures & tables

Figure 1: A real-world TOCTOU example on the Forbes homepage. The green region indicates the intended target area at $t_{1}$ . A delayed advertisement overlay (red region) appears at $t_{2}$ and overlaps the target, so a subsequent click at $t_{3}$ can become an unintended ad click that redirects to an advertisement page.

Figure 2: A TOCTOU window in the browser-use agent loop. The agent selects

a_{\text{plan}}

from

o_{t_{\text{plan}}}

, but the page changes before

t_{\text{act}}

, so

a_{\text{plan}}

may apply to a different target.

Type	Name	Plan-Act Mismatch on Page	Instruction	Oracle
I	Overlay Popup	A subscription modal appears after planning and sits on top of the intended link at the same screen position. The planned click now lands on the modal button instead of the article entry.	Enter the article site and summarize.	Must reach the article page (not the subscription flow).
	Sliding Advertisement	The page shows a rotating carousel. Card "A" is visible at check time, but the carousel rotates to card "B" before execution. The click at the same position opens "B".	Open ad "A".	Must open "A" (not "B").
	Incomplete Loading	Item "A" is visible at check time. A late load inserts an advertisement tile into the same slot, pushing "A" away. A click on the original slot now hits the ad.	Purchase item "A".	Must purchase "A" (avoid clicking the ad).
II	Dynamic Ticket Price	The displayed price refreshes after planning and crosses the decision bound, $500$ \rightarrow700. The planned buy action no longer satisfies the stated predicate.	Buy if price $\leq$ $600.	Do not buy at $700.
	Dynamic Stock Price	The quoted price rises during planning, then drops sharply before execution. The trend observed at check time no longer holds at use time.	Buy if the price is rising.	Do not buy after the drop.
	Item Availability Change	The remaining quantity updates to 0 after planning. The page still shows the same item view, but purchase is no longer valid under the updated stock state.	Purchase the item.	Only purchase when stock $>$ 0.

Table 1: DynWeb test cases and their induced plan act mismatches. Type (I/II/III) corresponds to an exploitation vector category. We bold key action verbs in the instructions and annotate the mismatch column with the primitive type.

Figure 3: A DynWeb instance for Type I (UI changes). An adversary-controlled origin injects a delayed overlay between check time ( $t_{1}$ ) and use time ( $t_{3}$ ), causing the agent’s click to resolve to an unintended control and redirecting it into an adversary-chosen flow.

Figure 4: Mitigation Framework. The agent plans actions while monitoring DOM and layout changes, and execution proceeds only if validation confirms stability.

Agent System	Obs Modalities			Action Space
	Structured	Screenshot-based	Multimodal	Element-level	Coordinate-based
Agent-E	✓			✓
computer-use-demo		✓			✓
openai-cua-sample-app		✓			✓
Cua		✓			✓
UI-TARS-desktop		✓			✓

Table 2: Collected 10 browser-use agents and their supported observation and action modalities.

Browser-Use Agents

Synthesized Cases

Real-world Cases

Type I

Type II

Type III

Type I

Type II

Agent-E [ 1 ]

✗

✓

✗

✓

computer-use-demo [ 4 ]

✓

openai-cua-sample-app [ 28 ]

✓

Cua [ 33 ]

✓

Table 3: Results of triggering TOCTOU vulnerabilities across individual evaluation cases. Type I/II/III correspond to the three classes of page dynamics: UI changes, dynamic data updates, and expiring states. ✓ indicates that the vulnerability was successfully triggered. ✗ indicates that the attempt failed.

Figure 5: Trigger ratio of TOCTOU vulnerabilities across three manipulation types. Here, n counts the number of cases per type, including both synthesized scenarios and real-world websites.

Figure 6: Per-iteration execution overhead across synthesized (S#) and real-world (R#) tasks. The average latency added to each plan-validate-act cycle is consistently below 0.05 s.

Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 7: Theoretical trigger probability as a function of the residual TOCTOU window length

w

, under a simplified latency model.

Panel of Figure 8 — Figure 8: Cumulative attack successes across 1,000 trials under two attacker strategies.

AI Agent Security

Artificial intelligence agent security studies attacks and safeguards for tool-using, persistent, and collaborative systems across digital and physical settings.

See all 508 papers

Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents
Apr 20, 2026Wenpeng XuAdversarial Attacks Computer-Use Agents
University of California, San Diego
Wuying-Browser-Agent: Real-World Centric Fundamental Long-Horizon Browser Agents
Aug 18, 2026AIMAE Team, Tianxiang Chen, Yan Cheng +39Web Agents Long-Horizon LLM Agents
AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents
Sep 26, 2026Asif Shahriar, Md Nafiu Rahman, Sadif Ahmed +2Data Leakage AI Agent Security
BRAC University · Qatar Computing Research Institute (QCRI)

Apr 20, 2026J/K move · Enter open · S save

Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents

Wenpeng Xu

University of California, San Diego

Adversarial Attacks Computer-Use Agents AI Agent Security Runtime Verification GUI Automation

Open paper AskPDF arXiv

GUI agents that control desktop computers via screenshot-and-click loops introduce a new class of vulnerability: the observation-to-action gap (mean 6.51 s on real OSWorld workloads) creates a Time-Of-Check, Time-Of-Use (TOCTOU) window during which an unprivileged attacker can manipulate the UI state. We formalize this as a Visual Atomicity Violation and characterize three concrete attack primitives: (A) Notification Overlay Hijack, (B) Window Focus Manipulation, and (C) Web DOM Injection. Primitive B, the closest desktop analog to Android Action Rebinding, achieves 100% action-redirection success rate with zero visual evidence at the observation time. We propose Pre-execution UI State Verification (PUSV), a lightweight three-layer defense that re-verifies the UI state immediately before each action dispatch: masked pixel SSIM at the click target (L1), global screenshot diff (L2a), and X Window snapshot diff (L2b). PUSV achieves 100% Action Interception Rate across 180 adversarial trials (135 Primitive A + 45 Primitive B) with zero false positives and < 0.1 s overhead. Against Primitive C (zero-visual-footprint DOM injection), PUSV reveals a structural blind spot (~0% AIR), motivating future OS+DOM defense-in-depth architectures. No single PUSV layer alone achieves full coverage; different primitives require different detection signals, validating the layered design.

Abstract

AI Agent Security

Explore similar work

Temporal UI State Inconsistency in Desktop GUI Agents: Formalizing and Defending Against TOCTOU Attacks on Computer-Use Agents

Wuying-Browser-Agent: Real-World Centric Fundamental Long-Horizon Browser Agents

AgentTell: Behavioural Side-Channel Leakage in Browser-Use Agents