Return to Threats

Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

thehackernews.com 2026-10-23 AI agent abuse Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A flaw in x402 SDK payment handling could let malicious APIs obtain authorization for an AI agent's full supported-token balance. Organizations operating AI agents that automatically sign API payments should review payment policies and update affected SDK clients.[1]

What Happened

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22. The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set

Affected Products

  • x402 SDKs
  • x402 TypeScript client
  • x402 Python client
  • x402 Go client

Vulnerability / Attack Technique

Unbounded agent-initiated payment authorization

Technical Mechanism

The default client set no spending limit, so a malicious API could request payment for the wallet's full balance of a supported token.[1] If the agent automatically signed payments and the application had not configured limits, the signed payment could be submitted and collected when the token supported signed transfers.[1]

AI Security Category

LLM06:2025 Excessive Agency

Part of the AI Agent Excessive Agency topic.

Relevant Frameworks

LLM06:2025 Excessive AgencyLLM10:2025 Unbounded ConsumptionLLM03:2025 Supply Chain

RealGround Analysis

This incident demonstrates how excessive autonomy in an AI agent can convert an ordinary API interaction into an irreversible financial action. The SDK dependency and its default configuration also create an AI supply-chain and business-logic risk for teams that do not independently enforce transaction boundaries.

Recommended Controls

  • Upgrade x402 clients to releases that include spending controls.
  • Set an explicit maximum amount for every agent-initiated payment.
  • Allow payments only to approved APIs, recipients, and recognized token types.
  • Require human or policy-based approval for payments above a low threshold.
  • Log, monitor, and alert on payment requests that exceed expected amount, token, or recipient constraints.

Related RealGround Service

AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-23.

Talk to AI CISO