`cp` isn’t vulnerable to this race condition. When `--no-clobber` is set, it checks whether the destination already exists; if it determines it doesn’t, and it should therefore proceed with the copy, it remembers that it’s supposed to copy to a new file. When the time comes to open the destination file, it opens it with flags which enforce its creation, `O_CREAT` and `O_EXCL`; the operating system then checks that the file doesn’t exist _while opening it_ , and fails (`EEXIST`) if it does.