Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

AI agents using x402 SDKs were vulnerable to having their entire token balances drained by malicious APIs, security firm V12 revealed on October 22. The vulnerability existed in the SDKs' default client, which previously set no spending limits until fixes were implemented on August 18.

The dangerous flaw was one of 25 issues V12 discovered in the x402 codebase, with three classified as critical. The x402 Foundation, which maintains these SDKs, has already addressed all three critical vulnerabilities in their August 18 releases.

The vulnerability specifically affected AI agents that automatically signed payments and had no spending limits set by their applications. This combination allowed hostile APIs to transform routine data requests into demands for the wallet's complete balance of supported tokens.

Payment Bypass in Solana Transactions

Another critical flaw affected the TypeScript SDK's facilitator code for Solana, which failed to properly validate token approval transactions. The facilitator accepted token approvals—which allow future spending but don't move tokens—as valid payments, creating a complete payment bypass vulnerability.

This meant merchants could deliver resources while receiving no actual payment, with the facilitator covering transaction fees each time. The Python and Go SDKs already had proper validation, which was added to the TypeScript version in the August 18 updates.

Unauthorized Login Signatures

The third critical vulnerability involved the Sign-In-With-X (SIWx) extension, which allows agents to log in by signing messages with their wallets. The automated client signed these messages without verifying that the website named in them matched the actual site contacted.

This flaw enabled malicious servers to obtain login messages for other sites and use the agent's signature to authenticate as that agent on those sites. The August 18 releases now require clients to verify that the site in the message matches the site that sent the 402 response before signing.

Required Updates and Mitigations

Developers using x402 SDKs must upgrade to the latest versions to protect against these vulnerabilities. As of October 23, the latest releases include version 2.28.0 for most TypeScript packages, 2.28.0 for the Go module, and 2.25.0 for the Python package.

After updating, clients are capped at $1 per payment by default and limited to recognized stablecoins like USDC unless applications implement their own spend controls. Teams unable to upgrade immediately can register payment policies that reject transactions above specified amounts.

V12 recommends additional security measures including verifying SIWx login message URLs, setting payment budgets, and limiting which tokens, networks, and recipients can be paid. The x402 Foundation has not published formal security advisories for these flaws, though fixes are documented in release changelogs.