Hunt Agent Race Conditions

Agents invoke tools in parallel. When tools share state (balance, quota, inventory, permission flag, counter) without synchronization, the window between check and commit is exploitable. In enterprise autonomous/workflow agents this is on-behalf financial or approval actions — real money and access.

Where This Lives / Attack Surface Signals

• Separate create+execute, reserve+commit, request+approve, check+deduct pairs.
• A tool reads a balance/quota/count/flag before acting.
• Multi-agent sharing state, no mention of locks; "reserve/lock" semantics (often non-atomic).
• Financial/inventory/permission/coupon/approval language.

Crown Jewel Targets

Payment/ledger agents (double-spend), quota/entitlement systems (limit bypass), approval workflows (self-approve during the window), multi-agent shared privilege flags.

Characterize First

1. Find the check→act split and the shared state.
2. Baseline the sequential guard — do the second op normally, confirm it's correctly rejected. Without this you can't prove the race did anything.
3. Find the smallest parallel unit (two execute on pre-created items — no LLM reasoning in the hot path).