Mind the Gap: Time-of-Check to Time-of-Use Vulnerabilities in LLM-Enabled Agents

TL;DR

This paper investigates time-of-check to time-of-use vulnerabilities in LLM-enabled agents, introducing a benchmark and proposing detection and mitigation techniques to improve security against such attacks.

Contribution

It is the first study to explore TOCTOU vulnerabilities in LLM agents, providing a benchmark and adapting security techniques for this context.

Findings

Achieved up to 25% detection accuracy with automated methods.

Reduced vulnerable plan generation by 3%.

Decreased attack window by 95%.

Abstract

Large Language Model (LLM)-enabled agents are rapidly emerging across a wide range of applications, but their deployment introduces vulnerabilities with security implications. While prior work has examined prompt-based attacks (e.g., prompt injection) and data-oriented threats (e.g., data exfiltration), time-of-check to time-of-use (TOCTOU) remain largely unexplored in this context. TOCTOU arises when an agent validates external state (e.g., a file or API response) that is later modified before use, enabling practical attacks such as malicious configuration swaps or payload injection. In this work, we present the first study of TOCTOU vulnerabilities in LLM-enabled agents. We introduce TOCTOU-Bench, a benchmark with 66 realistic user tasks designed to evaluate this class of vulnerabilities. As countermeasures, we adapt detection and mitigation techniques from systems security to this setting and propose prompt rewriting, state integrity monitoring, and tool-fusing. Our study highlights challenges unique to agentic workflows, where we achieve up to 25% detection accuracy using automated detection methods, a 3% decrease in vulnerable plan generation, and a 95% reduction in the attack window. When combining all three approaches, we reduce the TOCTOU vulnerabilities from an executed trajectory from 12% to 8%. Our findings open a new research direction at the intersection of AI safety and systems security.