<![CDATA[🔴 Critical: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances]]>AI agents using the x402 SDKs to pay for API calls could be tricked into signing away their entire balance of a supported token if a malicious API requested it, according to security firm V12 on October 22.

The root cause was the SDKs' default client, which applied no spending limit until releases on August 18 introduced one. Exposure was limited to agents that automatically signed payments and whose applications did not otherwise constrain what they would approve.

  • The default client in older x402 SDK releases enforced no spending cap.
  • A spending limit was added in releases dated August 18.
  • Agents affected are those that sign payments automatically without app-level restrictions.

Developers running x402-based agents should confirm they are on a release from August 18 or later, and should verify that their applications enforce their own limits on what payment requests an agent will sign rather than relying solely on SDK defaults.

Source: The Hacker News

Does your organization run x402-based agents, and have you confirmed which SDK release they are using?

]]>https://xploitlk.com/topic/780/critical-critical-x402-sdk-flaw-could-let-malicious-apis-drain-ai-agents-token-balancesRSS for NodeTue, 27 Oct 2026 07:24:50 GMTSat, 24 Oct 2026 22:30:19 GMT60