x402 SDK flaws could drain agent balances or bypass payments
Original title: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
V12 says three critical issues were fixed on August 18; neither side has reported attacks, and audits still list no advisories.
V12 said on October 22 that x402 SDK default clients set no spending limit until August 18 releases, so an auto-signing agent could sign a payment for its full balance of a supported token. Two other critical flaws let the TypeScript Solana facilitator accept a zero-token approval as payment and let a malicious server obtain a Sign-In-With-X login for another site. The x402 Foundation fixed all three on August 18 without a security advisory. The Hacker News found npm and PyPI still showed no advisories for the last pre-fix releases.
Unconfirmed: V12's local tests did not send a live Solana transaction, and no attacks have been publicly reported.
- Defaults now cap payments at $1 and recognized US dollar stablecoins such as USDC.
- @x402/svm 2.0.0 through 2.22.0 lack the Solana instruction check; 2.23.0 adds it.
- Latest versions cited are 2.28.0 for the TypeScript packages and Go module, and Python 2.25.0.
- SIWx clients must match the 402 site; createSIWxPayload callers must pass that URL.
- A later payment bypass fix is in @x402/core 2.27.0.
Impact: Full token-balance drain, unpaid Solana delivery, or forged site login
| Product | Affected | Fixed in |
|---|---|---|
| x402 Foundation x402 TypeScript, Python, and Go clients | Releases before the August 18 spend-limit fix | August 18 releases; TypeScript clients via @x402/fetch or @x402/axios 2.23.0 or later |
| x402 Foundation @x402/svm | 2.0.0 to 2.22.0 | 2.23.0 |
| x402 Foundation @x402/extensions | SIWx builds before the site-match check | 2.23.0 |
- 1.Update payment clients to @x402/fetch or @x402/axios 2.23.0 or later.
- 2.Move Solana facilitators to @x402/svm 2.23.0 or later.
- 3.Update SIWx apps to @x402/extensions 2.23.0 or later; latest cited builds are 2.28.0 and Python 2.25.0.
- Vendors
- Coinbasex402 Foundation
- Organizations
- V12Linux FoundationVisaMastercard
From the original article
5 min read at thehackernews.com
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.