x402 SDK Flaw Lets Malicious APIs Drain AI Token Balances

Introduction

Security researchers at V12 disclosed a critical vulnerability affecting the x402 SDK, a payment protocol enabling AI agents to transact with API providers using cryptocurrency tokens. The flaw, revealed on October 22, allowed malicious API endpoints to trigger unauthorized payments draining the full token balances of vulnerable agents. The root cause traced back to the SDK's default client configuration, which imposed no spending limit on automated payment signatures until patches released on August 18 introduced one.

How the Vulnerability Worked

The x402 SDK facilitates machine-to-machine payments by allowing AI agents to automatically sign and settle transactions when accessing paid APIs. However, the default client shipped without any spending cap, meaning that if an agent was configured to auto-sign payments and the host application did not enforce its own limits, a malicious API could request payment for the agent's entire supported token balance in a single transaction. This created a scenario where a seemingly routine API call could result in total fund depletion, with the agent unknowingly authorizing the transfer.

• The vulnerability required three conditions: auto-signing enabled, no application-level spending limit, and interaction with a malicious API.
• Only agents using supported tokens were at risk, and only if they had sufficient balance to be drained.
• The issue was resolved with SDK releases on August 18, which introduced a default spending limit.

Who Is Affected

The vulnerability primarily impacted AI agents built using the x402 SDK that were configured to automatically sign payment requests without additional safeguards. Applications integrating the SDK prior to the August 18 releases were at risk if they relied solely on the default client behavior. Organizations deploying autonomous agents for API consumption, particularly those handling user-owned token balances, needed to assess their exposure. The risk was limited to agents whose applications set no independent spending controls, highlighting the importance of layered security beyond SDK defaults.

What Readers Should Do Now

Defenders and developers should take the following steps immediately:

• Update the x402 SDK to the latest version released on or after August 18 to ensure the default spending limit is enforced.
• Audit agent configurations to confirm that auto-signing is disabled or paired with strict spending caps at the application level.
• Review transaction histories for any unauthorized or unusually large payments that may indicate exploitation.
• Implement defense-in-depth by enforcing spending limits within the application layer, regardless of SDK defaults.
• Educate teams on the risks of automated payment signing and the necessity of explicit authorization policies.

Conclusion

The x402 SDK vulnerability serves as a cautionary tale about the risks of automated financial transactions in AI ecosystems. While the August 18 releases addressed the immediate flaw, the incident highlights the need for proactive security measures in agent-based architectures. Organizations building or deploying AI agents that interact with paid APIs must prioritize secure defaults, enforce spending limits, and maintain visibility into transaction patterns. At Grivyonx, our AI automation and DevSecOps solutions help teams embed security into every stage of the development lifecycle, ensuring that emerging technologies like autonomous agents operate safely and reliably.