x402 SDK flaws could let malicious APIs drain AI agents' token balances
Security firm V12 found 25 flaws in the x402 payment SDKs used by AI agents, including three critical issues that were quietly fixed in August without a public advisory.
At a glance
- V12 found 25 flaws in x402 SDKs; three critical ones were fixed in the August 18, 2026 releases.
- Default clients had no spending cap, so a malicious API could request an agent's entire token balance.
- Other bugs allowed a Solana payment bypass and cross-site login signing via Sign-In-With-X.
- No attacks are known, but no advisory was published and package audit tools did not flag affected versions.
Security firm V12 has disclosed 25 vulnerabilities in the software development kits for x402, an open standard that lets AI agents pay for API calls within a web request, including three critical flaws that could let a malicious API drain an agent's token balance. According to The Hacker News, the three critical issues were fixed in releases published on August 18, 2026, but the x402 Foundation, a Linux Foundation project whose members include Visa and Mastercard, did not publish a security advisory. The findings, released on October 22, highlight the financial risks of letting autonomous agents sign payments automatically.
What happened
Coinbase created x402 and handed it to the Foundation in 2026, The Hacker News reported, though the article does not say Coinbase itself was affected. V12 found that, before the August releases, the SDKs' default clients imposed no spending limit. If an agent used an automatic signer and its application had not set a payment policy, a malicious API could request payment of the agent's full balance of a supported token.
Technical details
The other two critical flaws, according to the report, were:
- Solana payment bypass: every
@x402/svmrelease from 2.0.0 through 2.22.0 accepted token approvals as payments, which V12 called "a complete payment bypass" in which a merchant delivers a resource but receives no tokens. This was demonstrated only in a local test. - Cross-site login signing: automated clients signed Sign-In-With-X (SIWx) messages without checking which site they named, allowing a malicious server to relay another site's login message and sign in as the agent's wallet.
The fixes cap each payment at $1 by default in the TypeScript, Python and Go clients, accept only recognized USD stablecoins such as USDC, add an instruction-type check for Solana, and refuse to sign SIWx messages for sites other than the one that sent the payment request.
Who is affected
Developers running agents or services built on older x402 SDK versions are exposed. V12 and the Foundation have not reported any attacks. However, The Hacker News noted that as of October 23, npm audit showed no advisories for the last affected TypeScript releases and PyPI listed no vulnerabilities for the last affected Python release, so dependency scanners would not flag them.
What to do
Upgrade to the current releases: 2.28.0 for the @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios packages and the Go module, and 2.25.0 for the Python package. Applications that set spendControls: false disable the new protections. If upgrading is not possible, register a payment policy with a maximum amount, verify that SIWx messages name the site you contacted, and, as V12 recommends, set per-payment and total budgets and restrict allowed tokens, networks and recipients.
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
