Skip to content

Near-miss · Oct 22, 2026 · Agent payment rail

x402 SDK default client had no spending cap, so a hostile API could request an agent's full token balance

Amount
No loss reported
no exploitation reported
Affected
x402 Foundation SDKs (@x402/fetch, @x402/axios, Python, Go)
Chains
Base, Solana, Other
Status
Confirmed by the affected party or a post-mortem

What happened

Security firm V12 said on 22 October 2026 that the x402 SDKs' default client set no spending limit, so a malicious API answering with HTTP 402 could get an automatically signing agent to authorize a payment for its full balance of a supported token, The Hacker News reported. V12 reported 25 findings, three critical, on 12 August 2026; fixes shipped on 18 August (TypeScript 2.23.0) adding a default $1 per-payment cap and a stablecoin allowlist. The Hacker News and the Cloud Security Alliance said no security advisory was published, so npm audit and PyPI showed no warning for affected releases; neither V12 nor the Foundation reported attacks.

Why it happened

  • No effective spend limit

    No per-payment or per-window cap held, so one bad decision moved a lot.

    Ask of your own agent: How much can your agents really spend in one window?

  • Prompt injection

    Hostile text (a message, web page, tool response or memory) steered the agent into moving money.

    Ask of your own agent: Can anything your agent reads reach the tool that signs?

Free checks for this pattern, in your browser:

Sources

  1. Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents' Token BalancesThe Hacker News · news · Oct 23, 2026 · I checked the page: it names this incident Nov 8, 2026
  2. x402 Payment SDK Flaws: The Missing Advisory TrailCloud Security Alliance · research · Oct 26, 2026 · I checked the page: it names this incident Nov 8, 2026

Added Nov 8, 2026, last updated Nov 8, 2026. I wrote this from the sources above; nothing here goes beyond what they report. Involved in this incident, or see an error? Send a correction or a reply; replies from affected parties are added to the entry, dated.

Could the same thing happen to your agent?

Send me one real agent workflow. In my free 48-hour integration review I go through it end to end against this incident's pattern (no effective spend limit, prompt injection) and send you a written report: where the same path exists, what would stop it, and the tests that prove it.

Request the free 48-hour review

This is a record of public reports, not a security audit, legal, compliance or investment advice. Names appear only as the sources report them.