# Computer-Use and TOCTOU: What You Click Is Not What You Get!

Claude Computer-Use agent's screenshot-reasoning delay enables TOCTOU: a phishing page swaps a button to align with Outlook's Send, sending attacker-controlled email.

- Payout: Research
- Severity: medium
- Program: Anthropic
- Write-up by: Johann Rehberger
- Disclosed: 2026-06-25
- Write-up quality: 7/10
- Original: https://embracethered.com/blog/posts/2026/toctou-agent-what-you-click-is-not-what-you-get/
- Library page: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2026-toctou-agent-what-you-click-is-not-what-you-get
- Tags: area:ai domain:ai impact:integrity kind:research platform:research sev:medium tech:llm technique:chained technique:race-window vuln:prompt-injection vuln:race-condition

**Target:** Computer-Use AI agent (screenshot-driven browser automation)
**Root cause:** The agent takes a screenshot, spends seconds on LLM inference, then clicks at coordinates without verifying the UI is unchanged, so the page can swap the intended button for a different one at the same location.
**Steps:**
1. Craft phishing page with a 'Continue' button positioned exactly over Outlook's 'Send' button location.
2. Prompt-inject the agent to open `https://outlook.office.com/mail/deeplink/compose?to=...&subject=...&body=...` to pre-draft an email.
3. Add a bash `1+1` calculation step to the injection to stall the agent ~4-5s while Outlook loads.
4. Agent screenshots the phishing page, reasons, then clicks the Continue coordinates which now hit Outlook's Send, dispatching the email.
**How found:** Inspired by Jun Kokatsu's ChatGPT Operator TOCTOU disclosure; hypothesized the screenshot-then-infer-then-act loop leaves a race window, confirmed with a simple OKAY/ENTER THE MATRIX button swap that reliably fooled Claude, then weaponized via Outlook deeplink.
**Exploitation:** Attacker-controlled page plus prompt injection makes the agent open an Outlook compose deeplink and then click at coordinates that coincide with Send, sending an arbitrary email without user intent.
**Escalation:** Same TOCTOU primitive generalizes to data exfiltration, settings/config modification, and other agent actions on stale pixels.
**Insight:** Agent action latency is the race window: align attacker UI elements to the exact pixel coordinates of a sensitive target button (e.g. Send) and insert a slow side-task (bash calc) to cover page load time.