Critical x402 SDK Flaws Could Let a Malicious API Empty an AI Agent's Wallet

AI agents that pay for API calls on their own are becoming normal. A newly disclosed set of bugs in the official x402 SDKs shows the risk: with the old defaults, a hostile API could ask an agent to pay with its entire token balance, and the agent would sign.

What happened

x402 is an open standard that lets software, including AI agents, pay for an HTTP request without a human approving each payment. The server answers with HTTP 402 Payment Required and a list of payment options. The client picks one, signs a payment and resends the request. Coinbase created the protocol and has since handed it to the x402 Foundation, a Linux Foundation project.

Researchers at security firm V12 reviewed the x402 code and ran local tests. They reported 25 issues, three of them rated critical. The x402 Foundation fixed all three in its August 18 releases. Neither V12 nor the foundation has reported any attacks using the flaws.

The three critical issues:

• No spending limit in the default client. The client took the first payment option the server offered and put no cap on the amount. A malicious API could turn an ordinary request into a demand for the wallet's full balance of a supported token. If the agent signed payments automatically and the app set no payment policy, it would pay.
• Token approvals accepted as Solana payments. The TypeScript Solana facilitator (@x402/svm, versions 2.0.0–2.22.0) checked that a transaction called an allowed token program but not which instruction it ran. A token approval moves no funds, yet it passed as a valid payment. V12 called this a complete payment bypass: an attacker could get a paid resource without paying, while the merchant's facilitator still paid the transaction fee. The Python and Go SDKs already checked the instruction type.
• Logins signed for other websites. x402's Sign-In-With-X (SIWx) extension lets an agent log in by signing a short message with its wallet. The automated client signed these messages without checking that the site named in the message was the site it was talking to. A malicious server could relay a login challenge from another site, get the agent to sign it, and log in there as the agent.

Why it matters

The fixes were easy to miss. The changelogs listed them without saying they were security fixes, and as of October 23, npm audit reported no advisories for the affected TypeScript releases. Teams that rely on those checks to decide when to upgrade may still be running vulnerable versions.

More broadly, this shows a new kind of risk for autonomous agents. When software can spend money and sign logins without a human checking each step, every protection has to sit in code: spending caps, a list of allowed tokens and recipients, and checks that a signature is for the right site.

What to do

• Upgrade the SDKs. For TypeScript clients, update @x402/fetch or @x402/axios to 2.23.0 or later, which pulls in the matching @x402/core. Apps using SIWx also need @x402/extensions 2.23.0+. Facilitators that verify Solana payments need @x402/svm 2.23.0+. The Go module and the Python package also have patched releases. Check the x402 Foundation's security advisory for the exact versions.
• Check the new defaults. After upgrading, clients cap each payment at $1 and accept only recognized USD stablecoins such as USDC, unless the app sets its own spending controls. Apps that turn these off need their own limits.
• If you can't upgrade yet, register a payment policy that drops any option above a set amount: registerPolicy in TypeScript and Go, or register_policy in Python, which also has a ready-made max-amount policy.
• Set budgets on purpose. Limit spend per payment and in total, and restrict which tokens, networks and recipients an agent may pay.
• Treat agent wallets like production credentials. Watch them, keep balances low, and alert on unusual outflows.

Bugs like these sit in third-party SDK code that lands in your application through a dependency update. Our AI-assisted code review looks at how your code uses dependencies like these, including payment defaults, signature checks and missing limits, so these problems are found before an attacker finds them.

Source: original reporting by The Hacker News (Swati Khandelwal, October 23, 2026), based on research by security firm V12. This article is our own summary and analysis.