TOCTOU Race Condition in Computer-Use Agents (ChatGPT Operator-style)

Technical Analysis

Computer-use agents typically take a screenshot or DOM snapshot, reason about it, and then issue a click/action based on coordinates or selectors; the TOCTOU flaw arises because the page content can change (via JS, redirects, or dynamic DOM mutation) in the interval between the agent's 'check' (screenshot/plan) and its 'use' (executed click), so the actual element interacted with differs from what was verified or shown to the human for approval. The entry point is any attacker-controlled or attacker-influenced webpage the agent visits during a task. The attacker gains the ability to redirect a confirmed/reviewed action (e.g., a benign-looking button) into an unintended one (e.g., a payment confirmation, permission grant, or malicious download), effectively bypassing human-in-the-loop safeguards. This crosses the boundary between the agent's perception layer and actuation layer, and also undermines the human oversight control that many agent safety designs rely on as a last line of defense.

Affected Systems

ChatGPT Operator

Detection Signatures

• Rapid DOM mutations or element replacement occurring immediately before/after agent-issued click events
• Mismatch between screenshot used for planning and DOM state at action execution time
• Pages that redirect or swap interactive elements shortly after page load or after a rendering delay
• Unexpected click coordinates landing on elements not present at screenshot capture time
• High-frequency style/attribute changes on clickable elements (position, z-index, visibility) tied to timing windows

Remediation Steps

1. 1

   Re-verify state immediately before action

   Have the agent re-capture and re-validate the target element's identity, position, and content immediately before executing the click/action, not just at planning time.

2. 2

   Bind actions to stable identifiers

   Use unique, tamper-resistant element identifiers (not just coordinates) and verify they haven't changed between check and use.

3. 3

   Freeze or snapshot critical interactions

   For sensitive actions (payments, permission grants, downloads), require the DOM to be frozen or re-confirmed atomically, rejecting the action if content changed since last review.

4. 4

   Human-in-the-loop hardening

   Ensure human confirmation dialogs display the actual live state at click time, not a cached screenshot, to prevent visual mismatch attacks.

5. 5

   Rate-limit and monitor DOM mutation timing

   Detect and flag pages that mutate interactive elements in tight timing windows correlated with agent/user interaction.