TOCTOU perceive-then-act race in computer-use agents (Claude Computer-Use)
Research demonstration25 Jun 2026Security researcher Johann Rehberger (Embrace The Red) described a time-of-check to time-of-use (TOCTOU) race inherent to the perceive-then-act loop of computer-use / GUI agents. The 'check' is a vision-language model reasoning over a captured screenshot; the 'use' is the click it decides on. Because visual reasoning takes several seconds, the on-screen UI can change in the interval between capture and click, so the agent acts on stale perceived state — without any adversarial input reaching the model. Rehberger reports computer-use agents, including Claude Computer-Use, initially fell for a simple button-swap experiment. In a fuller demonstration an attacker-controlled phishing page positions a 'Continue' button exactly where Outlook's 'Send' will appear; an injected instruction to run a short bash calculation buys enough time for a pre-composed Outlook draft to load, so the agent's intended click on 'Continue' lands on 'Send' — a silent unintended action in the user's session. Per Rehberger, Anthropic acknowledged the risk ahead of the Computer-Use preview; when it later shipped Cowork with Computer-Use, developer Felix Rieseberg reportedly stated they 'ensure that pixels haven't changed before action' (revalidating the UI before executing a click). Independent reverse-engineering (Pluto Security) reportedly observed a corresponding pixel-validation control, and the class has since been formalized in academic work on temporal UI-state inconsistency in desktop GUI agents. Highlights a non-injection failure mode — a perception/action race — distinct from indirect prompt injection: the agent reasons correctly over what it saw, but the world moved underneath it. Payload and layout details are illustrative.
Risks it illustrates
Practise the risk class — related scenarios
Interactive simulations of the risk class this case illustrates (not a re-enactment of this specific event).
An ops agent gets one god-mode credential — and one misread wipes production
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
Subtract the refusal direction during generation — safety off, weights untouched
A compromised serving stack edits the model's activations — the weight hash never changes
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
An attacker plants prompt injection in the audit trail — so the LLM that hunts them erases the evidence
Encoded public text is laundered across an agent handoff into an on-chain transfer
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'