x402 SDKs lacked a default spending cap, letting malicious APIs drain AI agent token balances
V12 said the default client in the x402 SDKs set no spending limit until releases on August 18 added one, so an agent that auto-signed payments could approve its full balance of a supported token.
Security firm V12 said on October 22 that AI agents paying for API calls through the x402 SDKs could sign away their entire balance of a supported token if a malicious API asked for it.
The problem sat in the SDKs' default client, which set no spending limit until releases on August 18 added one. In other words, the safe behavior arrived later than the default that many integrations would have started with.
V12 described the risk as limited. It applied to agents that automatically signed payments and to apps that set certain conditions, which the source did not spell out in the retained text. Agents that required human approval, or that capped what they would pay, were not in the same position.
The lesson for teams running payment-enabled agents is to check what the client will sign without a human in the loop. Where a spending cap is available, set one, and treat any API endpoint that can name its own price as untrusted input. Reviewing which agents hold token balances, and how much, narrows the damage a single bad request can do.
The disclosure is a reminder that agent autonomy and payment authority are separate decisions, and that defaults often decide both.
Sources
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token BalancesPrimarythehackernews.com
If something here is wrong, tell us. Every correction is listed on the corrections page.
Don’t Just Read About Cyberattacks. Learn How They Work.
Go beyond the headlines. Explore hands-on cybersecurity labs, understand real-world vulnerabilities, and build practical security skills with HackZoneLabs.
Start Learning