Cocos AI Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks
An attacker who can modify the attested workload’s code, memory-backed state, or configuration after the initial attestation — but without necessarily terminating the existing TLS connection — can cause the peer to continue trusting the connection as if the originally attested state were still running.