What happened
V12 security research (published Oct 22) reported three critical flaws in x402, the standard AI agents use to pay for API calls inline. A malicious API could drain an agent's full token balance because the default client had no spending cap; a Solana facilitator could accept a token approval as a valid payment; and the login extension could sign a message for a different website. All three were fixed in the August 18 releases, but the x402 Foundation published no security advisory, so package-audit tools miss them.
Why it matters
Agentic payments are an emerging real-money attack surface. An agent that automatically signs payments, without application-level limits and with a server it talks to, can be steered into authorizing its whole balance — a direct financial impact class, not just data exposure.
Attack vector
(1) The default client set no spending limit, so a malicious API returning 402 could ask for the wallet's full balance of a supported token; with automatic signing and no app payment policy, the agent could sign it and the attacker collects. (2) On Solana, the TypeScript facilitator read a token approval as a valid transfer (it differs only in the first instruction byte), so a merchant delivered a paid resource while receiving no tokens — a 'complete payment bypass'. (3) The Sign-In-With-X client signed login messages without verifying the named site was the one contacted, letting a malicious server relay a login message to log in as the agent's wallet on another site.
Affected systems
x402 client SDKs (Copper/TypeScript/Python/Go @x402/*, @x402/svm, @x402/extensions) in releases before the 2026-08-18 fixes; only the TypeScript @x402/svm 2.0.0–2.22.0 facilitator had the approval-as-payment flaw
Mitigation
Upgrade to the latest releases (TypeScript @x402/fetch/@x402/axios/@x402/core to ≥2.23.0/2.28.0, @x402/svm to ≥2.23.0, @x402/extensions to ≥2.23.0, Go module ≥2.28.0, Python ≥2.25.0) which add default $1 spend caps, USDC-only recognition, instruction-type checks and SIWx site binding. Because no advisory was published, manually apply the fix and set explicit spend limits and trusted-recipient controls on any agent that auto-signs payments.