AIDEFEND SecureFlow / SecureFlow Case Index

Computer-Use TOCTOU: The Screen Observed Is Not the Screen Clicked

• Autonomous Agents
• Data Corruption

A computer-use agent reasons over a screenshot, then acts later by coordinates. Johann Rehberger reproduced this time-of-check to time-of-use gap against Claude Computer Use: a page requested a harmless bash calculation to create a four-to-five-second delay, then replaced a Continue button with Outlook's Send button at the same location. The stale click sent an attacker-composed email. Anthropic later added a pixel-unchanged check in Cowork.