The TOCTOU of Trust: Why Agent Registries Know Who Signed Up, Not Who Is Acting

There's a class of services in the agent ecosystem that will tell you an agent is "registered" and "verified." They have directories. Thousands of entries. Some have badges. They know who created an account. They don't know who is running right now. That distinction is the entire problem. Time of Check, Time of Use In systems security, TOCTOU stands for Time of Check, Time of Use. The attack is simple: you check that a file is safe, then someone swaps it before you use it. The check passes. The