<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="jiang-etal-2026-atomicity">
    <titleInfo>
        <title>Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Linxi</namePart>
        <namePart type="family">Jiang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Zhijie</namePart>
        <namePart type="family">Liu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Haotian</namePart>
        <namePart type="family">Luo</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Zhiqiang</namePart>
        <namePart type="family">Lin</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Browser-use agents automate everyday web tasks through structured DOM interfaces or vision-language models operating on page screenshots. However, web pages can change between observation and action execution due to advertisements, asynchronous loading, and timed updates, causing agents to act on stale assumptions. We frame this temporal mismatch as a time-of-check to time-of-use (TOCTOU) vulnerability in browser-use agents, where page changes during planning can alter the target, value, or validity of a planned action before execution. We introduce DYNWEB, a benchmark spanning synthesized and real-world websites, and evaluate 10 open-source agents as well as Codex’s computer-use feature across different observation and action modalities. All 11 evaluated systems exhibit at least one TOCTOU violation, showing that the vulnerability is not limited to a particular agent design. To reduce this exposure, we design a lightweight pre-execution validation mechanism that reduces the exploitable window from approximately 10 s to 0.13 s. Across three agent frameworks, the mechanism reduces the number of vulnerable DYNWEB cases to 0 out of 14. Adaptive attacks further show that stealthy single-mutation attacks succeed in at most 2.2% of trials, while event-driven timing reveals the limits of pre-execution validation.</abstract>
    <identifier type="citekey">jiang-etal-2026-atomicity</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.680/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>14277</start>
            <end>14291</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents
%A Jiang, Linxi
%A Liu, Zhijie
%A Luo, Haotian
%A Lin, Zhiqiang
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F jiang-etal-2026-atomicity
%X Browser-use agents automate everyday web tasks through structured DOM interfaces or vision-language models operating on page screenshots. However, web pages can change between observation and action execution due to advertisements, asynchronous loading, and timed updates, causing agents to act on stale assumptions. We frame this temporal mismatch as a time-of-check to time-of-use (TOCTOU) vulnerability in browser-use agents, where page changes during planning can alter the target, value, or validity of a planned action before execution. We introduce DYNWEB, a benchmark spanning synthesized and real-world websites, and evaluate 10 open-source agents as well as Codex’s computer-use feature across different observation and action modalities. All 11 evaluated systems exhibit at least one TOCTOU violation, showing that the vulnerability is not limited to a particular agent design. To reduce this exposure, we design a lightweight pre-execution validation mechanism that reduces the exploitable window from approximately 10 s to 0.13 s. Across three agent frameworks, the mechanism reduces the number of vulnerable DYNWEB cases to 0 out of 14. Adaptive attacks further show that stealthy single-mutation attacks succeed in at most 2.2% of trials, while event-driven timing reveals the limits of pre-execution validation.
%U https://aclanthology.org/2026.findings-emnlp.680/
%P 14277-14291

Markdown (Informal)

[Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents](https://aclanthology.org/2026.findings-emnlp.680/) (Jiang et al., Findings 2026)

• Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents (Jiang et al., Findings 2026)

ACL

• Linxi Jiang, Zhijie Liu, Haotian Luo, and Zhiqiang Lin. 2026. Atomicity for Agents: Exposing, Exploiting, and Mitigating TOCTOU Vulnerabilities in Browser-Use Agents. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 14277–14291, Budapest, Hungary. Association for Computational Linguistics.