Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

Summary: Security firm V12 reported on October 22 that the x402 SDKs' default client set no spending limit, so a malicious API could get an AI agent to sign a payment for its full balance of a supported token; the x402 Foundation had already added a limit in August 18 releases. The missing limit was one of 25 flaws V12 found in the x402 code and one of three it rated critical, alongside a TypeScript facilitator flaw that accepted a Solana token approval moving no tokens as valid payment and a SIWx flaw that let a malicious server obtain a login signature for a different website.
What's compelling: Neither V12 nor the x402 Foundation has publicly reported attacks, but as of October 23 npm audit and PyPI returned no advisories for the last releases before the fixes, so a developer relying on those checks gets no warning to upgrade. The August 18 releases now cap each payment at $1 and limit tokens to recognized US dollar stablecoins by default, and apps that pass spendControls: false turn those controls off.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026