Critical Flaw in x402 SDK Could Allow Malicious APIs to Drain AI Agent Token Balances

Critical Spending Limit Vulnerability

Security firm V12 reported on October 22 that a critical flaw in the x402 SDKs could enable malicious APIs to drain AI agents' token balances. The vulnerability stemmed from the SDKs' default client, which lacked a spending limit for payments. This meant that if a malicious API requested it, an AI agent configured to automatically sign payments could authorize a transaction for its entire balance of a supported token.

Additional Critical Flaws Identified

The missing spending limit was one of 25 flaws V12 discovered in the x402 codebase, with three rated as critical. Another critical flaw affected only the TypeScript SDK, allowing a payment facilitator to accept a Solana transaction with no token movement as a valid payment. The third critical flaw permitted a malicious server to trick an agent into signing a login message for an unintended website.

Fixes Implemented Without Advisories

The x402 Foundation, which maintains the SDKs, had already addressed all three critical vulnerabilities in releases made on August 18. However, neither V12 nor the x402 Foundation has publicly reported any exploitation of these flaws. The foundation did not publish security advisories for these fixes, and changelogs listed them without explicitly identifying them as security updates. This lack of clear communication means developers relying on tools like npm audit or PyPI for vulnerability checks would not be warned to upgrade.

How x402 Payments Work

x402 is an open standard designed to allow software, including AI agents, to pay for API calls directly within web requests, eliminating the need for manual approval of each payment. When a server requires payment, it responds with an HTTP 402 Payment Required status code, detailing payment options. The client then selects an option, signs the payment, and resends the request. The default client, prior to the fix, would automatically select the first payment option presented without any amount limitation.

Context and Impact

Coinbase initially developed x402 before transferring it to the x402 Foundation, a Linux Foundation project that includes members like Visa and Mastercard. Coinbase retains a senior position on the foundation's technical steering committee. The vulnerability highlights the risks associated with automated payment systems in AI agents, particularly when default configurations lack essential security controls like spending limits.