Flaw in x402 SDKs Let Malicious APIs Drain AI Agents’ Wallets

On October 22, security firm V12 disclosed a flaw in the x402 SDKs, the standard that lets software — including AI agents — pay for an API call inside the web request itself, without a person approving each payment.

The root cause was the default client, which set no limit on the payment amount until the August 18 releases. The risk was confined to agents that signed payments automatically in apps that set no limits of their own.

How it worked

A server demanding payment answers with HTTP 402 Payment Required and lists its options: an amount, a token, a recipient. The default client took the first option and signed. A hostile API could turn a routine data request into a demand for the wallet's full balance of a supported token — a small earlier payment revealed the address, letting the server look up the balance first. For tokens that support signed transfers, the attacker could then submit the signature and collect the funds.

This was one of 25 flaws V12 found and one of three it rated critical. All three were already fixed in the August 18 releases.

Two more critical flaws

The second let a facilitator — the service that checks payments — accept a Solana transaction moving no tokens as valid. The code checked that an allowed token program was called but not the instruction type, and a token approval differs from a transfer only in its first byte. In V12's local test the facilitator accepted such an approval; the firm called it "a complete payment bypass." Only the TypeScript SDK was affected.

The third concerned the Sign-In-With-X login extension: the client signed a login message without checking that the site named in it was the one it had contacted. A malicious server could relay a message from another site and log in there as the agent's wallet.

Fixes and silence

The August 18 releases added spend controls to the TypeScript, Python and Go clients: by default each payment is capped at $1 and only recognized stablecoins such as USDC are allowed. Solana payments now get an instruction-type check, and logins verify the site.

The x402 Foundation, to which Coinbase handed the standard this year (a Linux Foundation project whose members include Visa and Mastercard), published no security advisory. The changelogs list the fixes without calling them security fixes. The Hacker News found that neither npm audit nor PyPI flagged the last versions before the fix — a developer relying on those checks gets no warning to upgrade.

V12 advises checking the site in a login message before signing, setting per-payment and overall budgets, and limiting which tokens, networks and recipients an agent will pay. Neither V12 nor the foundation has reported any real-world attacks.

Source: The Hacker News