Skip to content
Neural Daily

ToolsNews

x402 flaws could let malicious APIs drain AI agent wallets

🇭🇺 Olvasd el magyarul →

Security firm V12 found 25 vulnerabilities in the SDKs for x402, the protocol AI agents use to pay for API calls. The three critical flaws were fixed in August, but no security advisory was ever published.

By: Mikola Máté Patrik · · 3 min read

V12 logo in chrome lettering on a black background
Image: V12 · Press kit · Official V12 blog post social image (og:image) · Source

What is x402?

x402 is an open standard that lets software, including AI agents, pay for an API call inside an HTTP request. The server responds with 402 Payment Required and its payment options, and the client signs a payment and retries. Coinbase created the protocol, which is now maintained by the x402 Foundation under the Linux Foundation.

The three critical flaws

V12 published its findings on October 22 (V12). It found 25 issues in total and detailed the three critical ones:

  • Solana payment bypass: the TypeScript facilitator did not check the instruction type, so it accepted a token approval as a payment. A merchant could deliver a paid resource without receiving any tokens.
  • Signatures for other sites: the Sign-In-With-X client did not verify that the login message named the site it had contacted. A malicious server could collect a signature for another site and take over the session there.
  • No spending limit: the default client set no cap on amounts. With automatic signing, a hostile API could request an agent's full balance of a supported token.

V12 reported the critical and high-severity issues on August 12. According to The Hacker News, the August 18 releases fixed all three critical flaws. The foundation, however, published no security advisory, and the changelogs don't flag them as security fixes, so npm audit and PyPI raise no warning for old versions. No attacks have been reported.

What to do

  • TypeScript: @x402/fetch or @x402/axios 2.23.0 or later. Apps using SIWx need @x402/extensions, and Solana facilitators need @x402/svm, also 2.23.0 or later.
  • Latest versions as of October 23: 2.28.0 for the TypeScript packages, v2.28.0 for the Go module and 2.25.0 for Python. These also include a fix for a separate payment bypass from September.
  • After upgrading, clients cap payments at $1 by default and allow only recognized stablecoins. Passing spendControls: false disables this, so avoid it.
  • If you can't upgrade yet, register a payment policy that drops options above a set amount.

Why it matters

A core promise of agent payments is that an agent can buy data or services without human approval. That's only safe if the client enforces strict limits. Anyone automating with x402 should check versions and set explicit per-payment and total budgets.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles