SecureRandom does not say anything about thread-safety. I am pretty certain that the intention was that SecureRandom should be thread-safe, and that SecureRandom would do the appropriate synchronization so that the Provider supplied SecureRandomSpi does not have to worry about anything.

We should double check that our code behaves that way and document it in the JavaDoc specification.