Introduction

Publication date: October 23, 2026
Category: Artificial Intelligence / Cryptocurrency

Security researchers at V12 have uncovered multiple critical vulnerabilities within the software development kits (SDKs) of x402, an open standard designed to facilitate native web payments for autonomous AI agents and decentralized applications. Among the most severe findings is a flaw that enabled hostile APIs to completely drain the token balances of AI agents due to the absence of a default spending limit in the client architecture. Although the x402 Foundation silently deployed patches in August releases, the lack of formal security advisories and explicit metadata flags in package registries left numerous automated operational environments exposed.

What is x402 and its SDKs? (General Analysis)

x402 is an open standard initially created by Coinbase and subsequently handed over to the x402 Foundation—a Linux Foundation project backed by industry leaders such as Visa and Mastercard. Its primary objective is to allow automated software, specifically AI agents, to execute native financial transactions directly within the web request flow (leveraging the HTTP status code 402 Payment Required) without requiring manual human intervention for every individual operation.

The x402 SDKs provide necessary abstractions in languages like TypeScript, Python, and Go to manage payment signing, interactions with payment facilitators, and authentication extensions. Because these components handle private keys and operate autonomously, strict enforcement of budget policies and protocol validation is critical.

Since no official CVE identifiers have been assigned in the National Vulnerability Database (NVD) at the time of this writing, the following reasoned technical severity estimates are provided based on the reported impact:

  • Estimated CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (Estimated Base Score: 8.6 - High / Critical).
  • Estimated CWE Classification: CWE-20 (Improper Input Validation) and CWE-710 (Improper Adherence to Coding Standards / Missing Default Limit).

How Does It Work? (Technical Analysis)

V12’s security review identified 25 shortcomings in the x402 codebase, highlighting three critical vulnerabilities that enabled direct exploitation vectors in autonomous architectures.

1. Missing Spending Limit in the Default Client

  • Initial Flow: The x402 standard operates when a server responds with HTTP status 402 listing payment options (amount, token, recipient). The default client automatically selected the first available option.
  • Exploitation Mechanism: Prior to the August patches, the client enforced zero spending limits. A malicious API could profile an agent via minor microtransactions to identify its wallet address, check its token balance on-chain, and subsequently demand payment for the wallet’s entire supported token balance.
  • Autonomous Execution: Because the agent operated with an automatic signer and lacked strict budgeting policies defined by the host application, it signed the full transfer, allowing the attacker to immediately harvest the funds.

2. Token Approvals Accepted as Solana Payments on Facilitators

  • Entry Vector: On the Solana blockchain, merchant servers rely on a facilitator service to check each payment and submit it to the blockchain while covering the transaction fee.
  • Logic Flaw: The TypeScript facilitator code verified that payments invoked an allowed token program, but processed the instruction as a generic transfer without checking the exact instruction type.
  • Evasion: A token approval—which authorizes another account to spend tokens in the future but transfers zero tokens instantly—differs from a transfer only in its first byte. Local testing showed the facilitator accepted such approvals as valid payments, delivering paid resources while transferring no actual tokens.

3. Logins Signed for Other Websites via SIWx Extension

  • Attack Mechanism: The Sign-In-With-X (SIWx) extension allows an agent to authenticate by signing a short message with its wallet. In vulnerable implementations, the automated client signed these payloads without verifying whether the website named in the message matched the server it originally contacted.
  • Session Hijacking: A hostile server could obtain a legitimate login message intended for an external site, pass it to the agent for signing, and use the resulting cryptographic signature to impersonate the agent’s wallet on the target site.

Affected Systems / Environments

The impact spans multiple official implementations of the x402 SDKs:

  • TypeScript SDKs (@x402/core, @x402/svm, @x402/extensions): Versions 2.0.0 through 2.22.0 (and specific components prior to August patches).
  • Python and Go Environments: Automated clients lacking strict spend control policies and SIWx validation checks prior to August 2026.
  • Impacted Profiles: Developers of autonomous AI agents, decentralized payment gateways, and applications integrating automated transactions without explicit budget limits (spendControls: true).

Mitigation and Detection

Remediation

  • Dependency Upgrades: Immediately update affected packages to the latest stable versions (e.g., update @x402/core, @x402/svm, @x402/extensions, @x402/fetch, and @x402/axios to version 2.28.0 or later; Go modules to v2.28.0; and Python packages to 2.25.0).
  • Budget Control Policies: Ensure applications do not disable default protections via configurations like spendControls: false. For legacy versions, implement explicit policies using registerPolicy (TypeScript/Go) or register_policy with max_amount (Python).
  • SIWx Hardening: Strictly validate that the target domain in authentication payloads matches the exact URL of the initial 402 response.

Detection

Blue teams should monitor network traffic and application logs for anomalous financial transaction patterns initiated by autonomous agents.

Defensive Intelligence Note: The absence of validation in automated payment flows and missing security metadata in package managers highlight the necessity of deploying intermediary proxy inspection layers that enforce strict per-transaction spending limits and cryptographically validate protocol parameters in decentralized AI environments.

Defenders should review network logs for API calls returning 402 status codes followed by signing requests involving unusually large amounts or zero-balance transfers across blockchain networks like Solana.

Wrapping Up

The discovery of 25 flaws in the x402 framework—including missing default spending limits and payment bypasses in blockchain facilitators—underscores the inherent risks of financial automation in AI agents. Although the x402 Foundation deployed timely corrective patches in August 2026, the absence of formal security advisories and registry warnings exposes critical gaps in the AI software supply chain. Rigorous adoption of budgeting controls and strict network metadata validation remain essential to prevent fund exfiltration in autonomous systems.

References