x402’s real problem cannot be patched.
Researchers from Hong Kong universities identified five critical flaws in x402 payment systems enabling attackers to drain agent token balances. Three were fixed by the x402 Foundation in August; full scope surfaced this week. The critical flaws: missing spending limits let hosts request full token balance; Solana payment bypass lets facilitators accept approvals as payments; cross-site hijacking enables servers to obtain agent signatures.
But fixing three doesn’t solve the underlying problem. x402 bolts blockchain semantics onto stateless HTTP, creating a mismatch. That gap spawns timing and context-binding breaks SDKs can only mitigate, not eliminate. Research identifies attacks like cross-resource substitution and probabilistic service duplication from this architectural tension, not code bugs.
The two-month delay from August fixes to disclosure signals severity. By publication, the story wasn’t about patches; it was about the protocol’s fundamental design being broken.
Sources: Free-Riding in the AI Economy: Demystifying Logic Flaws in x402-Enabled Payment Systems
Coverage: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances • x402 Protocol: 25 Vulnerabilities in AI Agent Payments Explained
Related on this blog: [AUTO] AI Agent Finds OTP Bypass, With Guardrails • [AUTO] AI-Orchestrated Campaign Compromised 395 Organizations • [AUTO] Workflow Identity Hijacking: The Authorization Gap