x402 SDK: 25 Flaws Could Let Malicious APIs Drain AI Agents' Crypto Wallets
V12 disclosed 25 flaws in the x402 SDKs, including three critical ones that could have let a malicious API drain an AI agent's crypto wallet, bypass Solana payments, or hijack accounts via relayed login signatures. All three were quietly fixed in August 2026 releases, but no security advisory was ever published.
Security firm V12 disclosed on October 22, 2026 a set of 25 flaws in the x402 SDKs, including three critical issues that could have let a malicious API endpoint drain an AI agent's entire token wallet balance, bypass payments on Solana entirely, or hijack an agent's account through a relayed login signature. The x402 standard, created by Coinbase and now maintained by the x402 Foundation, a Linux Foundation project whose members include Visa and Mastercard, lets software, including AI agents, pay for API calls automatically within web requests. According to The Hacker News, the flaws were found through code review and local testing, and all three critical issues were already fixed in releases published on August 18, 2026, roughly two months before the public disclosure.
What was the specific vulnerability?
The most critical of the 25 flaws was that the SDKs' default client set no spending limit on payments, so a malicious API could request an agent's full wallet balance of a supported token, such as USDC, and the agent would sign the payment automatically. According to V12, this turned a routine data request into a full wallet drain: the agent's own payment machinery, designed to make machine-to-machine commerce frictionless, became the attack vector. Any endpoint an agent was pointed at could name its own price, and the default configuration would pay it.
A second critical flaw affected only the TypeScript SDK's Solana facilitator code. It accepted a token approval, which moves no tokens, as a valid payment. V12 called this "a complete payment bypass": a merchant could deliver paid content while receiving nothing, with the facilitator paying the transaction fee each time. The vulnerable @x402/svm TypeScript releases span versions 2.0.0 to 2.22.0, with the fix arriving in 2.23.0.
A third flaw sat in the Sign-In-With-X (SIWx) extension. A malicious server could get an agent to sign a login message intended for a different website, enabling account takeover wherever the relayed message was accepted. The remaining 22 flaws in the set were of lower severity and are not detailed in the disclosure.
How was the incident detected?
The flaws were found by V12 through code review and local testing, with no evidence of exploitation in the wild. According to The Hacker News, neither V12 nor the x402 Foundation has publicly reported any attacks using these flaws. V12 disclosed the findings publicly on October 22, 2026, after the fixes had already landed in the August 18, 2026 releases.
The detection gap is itself part of the story. The x402 Foundation has published no security advisory for the three flaws, and its changelogs list the fixes without calling them security fixes. As of October 23, npm audit and PyPI returned no advisories for the last pre-fix releases, meaning developers relying on those automated dependency checks get no warning to upgrade. The fixes are visible only to teams that read the changelogs line by line or follow the disclosure coverage directly.
What is the current impact?
The impact is currently potential rather than observed: no known exploitation in the wild has been reported. AI agents using x402 SDKs to make automated API payments could have had their entire token wallet balance drained by a malicious API endpoint before the fix. Merchants relying on the TypeScript Solana facilitator could have been defrauded via the payment bypass, receiving nothing for content they delivered while the facilitator absorbed the transaction fees on each fake payment. Agent wallets could also have been impersonated through relayed SIWx login signatures, extending the risk beyond payments into account control.
All three critical flaws are patched. The August 18, 2026 releases added spend controls with a default cap of $1 per payment restricted to US dollar stablecoins, instruction-type checks for Solana, and site-match verification for SIWx signing. As of October 23, the latest fixed versions are 2.28.0 for @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios, and v2.28.0 for the Go module.
What are the next steps?
Developers running x402 SDKs should upgrade to the fixed versions immediately: 2.28.0 for the @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios TypeScript packages, and v2.28.0 for the Go module. Teams on @x402/svm releases 2.0.0 through 2.22.0 are exposed to the payment bypass and should prioritize the move to 2.23.0 or later.
Because npm audit and PyPI return no advisories for the pre-fix releases as of October 23, teams cannot rely on automated dependency checks to flag the upgrade; the x402 Foundation GitHub repository lists the fixed releases in its changelogs. Operators of agent wallets should also review whether any wallets were configured without spending limits before the August fix, and merchants using the Solana facilitator should reconcile delivered content against received payments for the vulnerable period. As of October 23, the x402 Foundation has not published a security advisory for the three flaws, and neither V12 nor the Foundation has reported any exploitation of them.