x402 SDK flaws could let malicious APIs drain AI agents' token balances
x402 SDKs (TypeScript @x402/*, Python x402, Go)
V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.
Why this severity: Three findings rated critical by V12; no exploitation reported
- Started
- Oct 22, 2026
Affected
- @x402/svm 2.0.0 to 2.22.0 (Solana approval accepted as payment)
- @x402/fetch and @x402/axios before 2.23.0 (no default spending limit)
- @x402/extensions before 2.23.0 (SIWx signs logins for other sites)
- Python and Go clients before the August 18, 2026 releases (no spending limit, SIWx check)
Fixed in
- @x402/fetch, @x402/axios, @x402/extensions, @x402/svm 2.23.0+ (latest 2.28.0)
- x402 (PyPI) 2.25.0 (latest)
- Go module v2.28.0 (latest)
Timeline2
The Hacker News found the foundation published no security advisory for the three flaws, so npm audit and PyPI report nothing for the last vulnerable releases. Patched clients now cap each payment at $1 and allow only recognized USD stablecoins unless the app sets its own spend controls.
V12 published 25 x402 findings with three critical ones detailed: no default spend limit, Solana ApproveChecked accepted as TransferChecked in the TypeScript facilitator (a complete payment bypass in local tests), and SIWx signing relayed login messages for other domains. The x402 Foundation had fixed all three in the August 18 releases.
News & write-ups2
Posts2
V12 found 25 vulnerabilities in the x402 protocol. Critical findings included: - Requests approved without any payment - Maliciously high requests being paid by default - Session takeover from relayed login signatures Here's how. 🧵 t.co/0jIv7VpET7
🚨 A malicious API could drain an AI agent's token balance via an x402 SDK flaw. V12 rated 3 bugs critical: — No default spending cap — Solana approvals passed as payments — Logins signed for other sites All patched. No advisory, so npm audit & PyPI miss them. Read more ↓ t.co/b455EukyKw
Notes & caveats
No CVE IDs or GitHub advisory for these three findings (an older, separate Solana facilitator advisory, GHSA-qr2g-p6q7-w82m, covered @x402/svm before 2.6.0). Teams that can't upgrade can register a payment policy that drops options above a set amount (registerPolicy in TypeScript and Go, register_policy or max_amount in Python). Apps passing spendControls: false turn the new limits off. Upgrading also picks up a separate September payment-bypass fix in @x402/core 2.27.0.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
