Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents

TOCTOU vulnerabilities represent a new security threat in AI agents: The paper identifies "time-of-check to time-of-use" attacks—where external information (like files or API responses) is validated by an LLM agent but then maliciously modified before the agent uses it—as a largely unexplored vulnerability class in LLM-enabled systems, distinct from previously studied prompt injection attacks.

Real-world attack scenarios are practical and concerning: The researchers demonstrate concrete attack examples including "malicious configuration swaps" and "payload injection," suggesting these vulnerabilities could have tangible security consequences in deployed agent applications across various domains.

Current defenses are only partially effective: Even when combining three mitigation techniques (prompt rewriting, state integrity monitoring, and tool-fusing), the researchers could only reduce TOCTOU vulnerabilities from 12% to 8% in executed trajectories, indicating that this remains a challenging problem without complete solutions.

Automated detection methods struggle with this threat: The paper reports that automated detection achieved only up to 25% accuracy, highlighting that current AI safety tools may not adequately catch these vulnerabilities before deployment.

This work bridges AI safety and systems security: By adapting classical computer security concepts to LLM agents, the paper suggests that responsible AI development requires interdisciplinary approaches drawing from established security practices, not just AI-specific safeguards.