The Stack
Your Agent Checked the Path, Then the Path Changed: TOCTOU Is How 'Safe' File Tools Escape the Sandbox
Every agent that validates a file path with realpath() and then opens it has a race window. An attacker — or the model's own concurrent code — swaps a symlink in that window and your allow-list writes to /etc. Here's the bug, the class of 2026 CVEs proving it's live, and the atomic fixes that actually close it.