Critical x402 SDK Flaws Allow Token Drain, Payment Bypass, and Login Hijacking
Multiple critical vulnerabilities discovered in the x402 SDK could enable attackers to drain AI agents' token balances, bypass payments, and hijack user logins.
Security researchers at V12 have uncovered a trio of critical vulnerabilities within the x402 SDK, a protocol designed to facilitate payments within web requests, potentially exposing AI agents and their token balances to significant risk. The most severe flaw allows malicious APIs to drain an AI agent's entire token balance by exploiting the SDK's default client, which previously lacked spending limits. This issue was particularly dangerous for agents that automatically signed payments and operated without application-level spending caps.
The root cause of the token-draining vulnerability lay in the x402 SDK's default client implementation. Until an update released on August 18, 2026, the client did not enforce any spending limits on transactions. This oversight meant that if a malicious API requested a payment for an agent's full token balance, and the agent was configured for automatic signing without any additional safeguards, the client could inadvertently approve and sign a transaction that depleted the entire wallet. An attacker could first perform a small transaction to ascertain the wallet address and its token balance, then craft a malicious request to drain it.
In response to these findings, the x402 Foundation, responsible for maintaining the SDKs, has already released fixes for all three critical vulnerabilities in their August 18th updates. The default clients for TypeScript, Python, and Go now include spend controls, capping individual payments at $1 and restricting them to recognized US dollar stablecoins like USDC. This significantly mitigates the risk of unauthorized token balance depletion.
Beyond the token drain, another critical flaw identified by V12 affected the TypeScript facilitator code for Solana payments. This vulnerability allowed the facilitator to accept a token approval transaction—which merely grants permission for future spending but does not transfer assets—as a valid payment. By manipulating the first byte of a transaction, an attacker could trick the facilitator into believing a payment had been made, thereby delivering a resource without actually receiving any tokens. The facilitator would even cover the transaction fee, making it a complete payment bypass. This issue has also been rectified in the latest TypeScript releases.
The third critical vulnerability concerned the Sign-In-With-X (SIWx) extension of the x402 protocol, which allows agents to authenticate by signing a message. The automated client would sign login messages without verifying that the website specified in the message matched the website the agent was interacting with. This could enable a malicious server to trick an agent into signing a login message intended for a different website, allowing the attacker to impersonate the agent's wallet on that other site. The updated SDKs now enforce a match between the website in the message and the originating 402 response, preventing such hijacking attempts.
While V12 discovered these flaws through code review and local testing, neither the firm nor the x402 Foundation has reported any instances of these vulnerabilities being exploited in the wild. Notably, the x402 Foundation has not issued a formal security advisory for these critical flaws, and their changelogs do not explicitly label the fixes as security-related. This lack of explicit notification could leave developers unaware of the need to upgrade, potentially prolonging exposure.
The x402 protocol, originally developed by Coinbase and now managed by the Linux Foundation with support from major financial players like Visa and Mastercard, aims to streamline API payments. The recent discoveries highlight the ongoing challenges in securing complex protocols, especially those involving automated transactions and AI agents, where the potential for rapid, large-scale financial loss is significant. Developers are urged to update to the latest SDK versions to incorporate these crucial security enhancements.