Security firm V12 found 25 flaws in the x402 agent payment code

V12 said on October 22 that it found 25 flaws in the x402 code. x402 is an open standard for AI agents. It lets them pay for each use of an API in the web message. V12 gave 3 flaws the top level. In one, an attacker could get an agent to sign a payment for its full token balance. The foundation made fixes for all 3 on August 18.

How it works

The default client had no limit on spending before August 18. The client used the first payment alternative that a server listed. An attacker could make the client sign a payment for the full balance of a token.

V12 found 2 more flaws at the top level. A Solana payment check accepted a transaction that moved no tokens. An agent could sign a login message for a different website.

The numbers

V12 found the flaws with code inspection and tests. V12 and the foundation report no attack. The new releases limit each payment to $1 and accept only US dollar stablecoins. Users must install version 2.23.0 or above.

What is not known

The foundation gave no advisory. Its changelogs do not name the fixes as security fixes. The Hacker News found that npm audit and PyPI show no warning for the previous releases. An app that sets spendControls to off removes all new limits.

Insight: Payment standards for agents add limits late

The BSV standard BRC-181 puts payment limits in the payment layer. The x402 default client had no limit until August 18. Coinbase made x402 and holds the top position on its technical steering committee. This reads as a contest to set the agent payment standard, where safety defaults come after use. Before you select a standard, find its default limits.