Critical x402 SDK flaws let malicious APIs drain AI agent wallets

AI agents using the x402 standard for automated micropayments faced a severe risk of having their entire token balances drained by malicious APIs. Security firm V12 disclosed on October 22 that default clients in the x402 software development kits lacked spending limits, allowing hostile servers to request and receive full wallet funds.

The x402 Foundation, which maintains these open-source tools, released fixes for these critical flaws on August 18, but the updates were not flagged as security patches in public advisories. This left many developers unaware of the danger despite the potential for significant financial loss in agentic workflows.

What happened

V12 identified 25 flaws in the x402 codebase, three of which were rated critical. The most dangerous vulnerability existed in the default client logic across TypeScript, Python, and Go SDKs. When an API server responded with an HTTP 402 Payment Required status, it could list payment options with arbitrary amounts. The default client would automatically select the first option and sign a payment for that amount without checking if it exceeded any reasonable limit.

An attacker could exploit this by first making a small, legitimate request to discover the agent’s wallet address. They could then look up the wallet's balance on the blockchain and craft a subsequent 402 response requesting that exact amount. If the agent’s application had not set specific payment policies, the SDK would sign the transaction, allowing the attacker to submit it and drain the funds. This risk was limited to agents configured to sign payments automatically without human intervention.

The other two critical flaws affected specific parts of the ecosystem. One vulnerability in the TypeScript facilitator for Solana allowed a "complete payment bypass." The facilitator, which validates payments before they reach the blockchain, failed to distinguish between a token transfer and a token approval. An attacker could send a token approval instruction, which moves no funds but grants spending permission, and the facilitator would accept it as a valid payment. The merchant would deliver the resource, but no tokens would change hands, while the facilitator paid the transaction fee.

The third flaw involved the Sign-In-With-X (SIWx) extension. Clients would sign login messages for Ethereum-based sites without verifying that the website named in the message matched the site they were currently contacting. A malicious server could relay a login message from a different, trusted site, tricking the agent into signing it. The attacker could then use this signature to log in to the trusted site as the agent, gaining unauthorized access.

How it works

The x402 standard enables machine-to-machine payments by embedding payment instructions directly into HTTP requests. When a server requires payment, it returns a 402 status code along with a list of payment options, each specifying an amount, token type, and recipient. The client selects an option, signs a cryptographic proof of payment, and retries the request. This process is designed to be seamless for AI agents that need to pay for API calls autonomously.

The vulnerability arose because the default client implementation prioritized convenience over safety. It automatically picked the first payment option presented by the server and, prior to the August 18 update, imposed no maximum spend limit. This trust model assumed that API providers would always request fair amounts, a assumption that fails when dealing with malicious actors. The fix introduces a default cap of $1 per transaction and restricts payments to recognized stablecoins like USDC, unless the developer explicitly configures different rules.

For the Solana facilitator issue, the problem was a lack of strict instruction validation. Token transfers and token approvals are similar data structures on the Solana blockchain, differing only in their initial instruction byte. The TypeScript facilitator checked if the transaction called a valid token program but did not verify the specific instruction type. By adding a check for the instruction type, the updated SDK ensures that only actual transfers are accepted as payment, preventing attackers from using empty approvals to trick the system.

Key details

• V12 discovered 25 flaws in x402 code, with three rated as critical and detailed in their report.
• The default x402 clients for TypeScript, Python, and Go had no spending limits before the August 18 releases.
• A Solana-specific flaw in the TypeScript facilitator allowed token approvals to be accepted as valid payments, bypassing actual fund transfers.
• The SIWx extension allowed agents to sign login messages for websites they were not currently visiting, enabling account takeover.
• Fixes were released on August 18, but no public security advisory was issued, and package registries like npm and PyPI did not flag the older versions as vulnerable.
• As of October 23, the latest secure versions are 2.28.0 for TypeScript/Go packages and 2.25.0 for Python.

Why it matters

For developers building AI agents that interact with paid APIs, this incident highlights the risks of automating financial transactions without strict safeguards. Agentic workflows often operate with high autonomy, meaning a single unchecked API call can result in immediate financial loss. The lack of explicit security advisories means that teams relying on standard vulnerability scanners like npm audit may remain unaware of the risk, leaving their production systems exposed even after patches are available.

This also underscores the importance of validating external inputs in decentralized payment systems. When money moves programmatically, the code must treat every payment request as potentially hostile. The x402 flaws demonstrate how subtle differences in blockchain instructions or missing domain checks in login flows can lead to complete system compromise. Teams must now audit their agent configurations to ensure they are not using outdated SDKs or disabling essential spend controls.

What you can do

• Upgrade all x402 packages to the latest versions: 2.28.0 for TypeScript and Go, and 2.25.0 for Python.
• Verify that your application does not set spendControls: false, which would disable the new default $1 cap and stablecoin restrictions.
• If you cannot upgrade immediately, register a payment policy using registerPolicy (TypeScript/Go) or register_policy (Python) to enforce a maximum amount per transaction.
• For Solana facilitators, ensure you are using @x402/svm version 2.23.0 or later to prevent payment bypass via token approvals.
• Update @x402/extensions to version 2.23.0 or later to enforce domain matching for SIWx login signatures.
• Audit your agent’s wallet permissions and consider using dedicated wallets with limited balances for automated API interactions.