Threat reportVulnerabilityTL-2026-4252
Critical x402 SDK Flaws Could Let Malicious APIs Drain AI Agents' Token Balances (No Default Spend Limit, Solana Approval-as-Payment, Unverified SIWx Domain)
Critical x402 SDK Flaws Could Let Malicious APIs Drain AI (TL-2026-4252), also tracked as x402 SDK spend-limit flaw, is a critical-severity software vulnerability, first published 2026-10-23. It has no confirmed attribution, affects x402 Foundation (originally Coinbase) x402 TypeScript SDK (@x402/core, maps to 5 MITRE ATT&CK techniques (T1036, T1199, T1550), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4252
- Threat ID
- TL-2026-4252
- Also known as
- x402 SDK spend-limit flaw, x402 SIWx domain-binding flaw, x402 Solana Approve-as-payment bypass
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- finance, technology, cryptocurrency, ai-agent-platforms
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
Malware and tooling: Python
How Critical x402 SDK Flaws Could Let Malicious APIs Drain AI works
V12 Security reported three critical flaws in the x402 Foundation SDKs (originally created by Coinbase) that could let a malicious paid API drain an AI agent's token balance, bypass payment on Solana, or harvest login signatures for unrelated sites. Fixes shipped 2026-08-18; no CVE or CVSS was assigned and no in-the-wild attacks have been reported.
x402 is an HTTP-native payment protocol in which a server answers with HTTP 402 Payment Required and the client (frequently an autonomous AI agent) signs a stablecoin payment, typically USDC, and retries the request. The x402 Foundation (a Linux Foundation project; Coinbase created x402 and holds a technical steering committee seat) maintains TypeScript, Python and Go SDKs. V12 Security reviewed the code and validated its findings with local tests only; it sent no live transactions. V12 reportedly identified 25 flaws in total and published details of the three it rated critical.
Flaw 1 - no default spending limit (TypeScript, Python, Go clients). Before the 2026-08-18 releases the default client applied no spending cap. A malicious or compromised API could return a 402 response demanding an arbitrarily large amount in any token, and an agent using the default client would sign it, draining the wallet balance. The fix (TypeScript PR #3124, merged 2026-08-13, with Python #3154 and Go #3156) adds a default cap of $1 USD per payment on recognized pegged assets (stablecoins such as USDC). Non-default assets need explicit opt-in via an allowedAssets list, and the spendControls option can adjust or disable the cap.
Flaw 2 - token approval accepted as payment (Solana, TypeScript only). In @x402/svm 2.0.0-2.22.0 the exact-scheme static validation checked that the instruction at index 2 belonged to the SPL token program but did not check the instruction discriminator. A token Approve instruction, which moves zero tokens, therefore passed as a valid payment, giving a complete payment bypass on the facilitator side. The fix (PR #3132, merged 2026-08-12) adds an explicit data[0] === 12 (TransferChecked) guard, bringing TypeScript in line with the Python and Go implementations, which already had the check. Fixed in @x402/svm 2.23.0 and later.
Flaw 3 - login messages signed without domain verification (SIWx; TypeScript, Python, Go). The automated client signed Sign-In-With-X challenges without confirming that the domain in the message matched the site it was contacting. A malicious API could relay a challenge for an unrelated website and obtain a valid wallet signature for a login there. The fix (TypeScript PR #3133, merged 2026-08-13, with Python #3192 and Go #3193) requires the challenge domain, URI and resources to match the origin of the 402 response URL, and aborts without signing or paying on mismatch. The specification was updated with the SIWx requirement.
Affected: @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios 2.0.0-2.22.0 (all fetch/axios/extensions/core releases before the 2026-08-18 fixes), plus the Go module and Python package before the 2026-08-18 releases. Latest versions as of 2026-10-23 are 2.28.0 (TypeScript and Go) and 2.25.0 (Python). As of 2026-10-23 no public security advisory had been published for these three flaws and npm audit and PyPI showed no warnings, so defenders must track versions themselves. V12 also noted a separate payment bypass in @x402/core 2.27.0 (September 2026). V12 recommends that clients check SIWx login messages, set per-payment and total budgets, and limit approved tokens, networks and recipients. Neither V12 nor the x402 Foundation has reported exploitation. Related but separate: GHSA-qr2g-p6q7-w82m (March 2026) covered an earlier Solana facilitator issue fixed in @x402/svm 2.6.0, and a July 2026 study reported 31 vulnerabilities across 15 x402 facilitators; neither should be conflated with the flaws described here.
MITRE ATT&CK techniques used in TL-2026-4252
Defense Evasion
Initial Access
lateral-movement
T1550 Use Alternate Authentication Material
Resource Development
Impact
Affected products and versions in Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
- x402 Foundation (originally Coinbase) — x402 TypeScript SDK (@x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios)
Vulnerable versions: 2.0.0-2.22.0 (@x402/svm Solana flaw); all releases before the 2026-08-18 fixes (spend limit and SIWx flaws)
Fixed in: @x402/svm 2.23.0+; @x402/extensions, @x402/fetch, @x402/axios 2.23.0+; @x402/core 2.28.0+; latest 2.28.0 - x402 Foundation (originally Coinbase) — x402 Python package (PyPI x402)
Vulnerable versions: releases before 2026-08-18 (spend limit and SIWx flaws)
Fixed in: 2.25.0+ - x402 Foundation (originally Coinbase) — x402 Go module (github.com/coinbase/x402/go)
Vulnerable versions: releases before 2026-08-18 (spend limit and SIWx flaws)
Fixed in: 2.28.0+
Remediation for Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
Patches
- @x402/svm 2.23.0 or later (fixes Solana approval-as-payment)
- @x402/core, @x402/extensions, @x402/fetch, @x402/axios 2.23.0 or later; latest 2.28.0
- x402 Go module 2.28.0; x402 Python package 2.25.0
Immediate actions
- Upgrade all x402 SDK packages to the latest releases: TypeScript @x402/* 2.28.0 or later, Go 2.28.0 or later, Python 2.25.0 or later (minimum fixed releases are dated 2026-08-18; @x402/svm needs 2.23.0 or later)
- Inventory AI agents and services that depend on @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios, the x402 PyPI package or the github.com/coinbase/x402/go module, and check lockfiles for pre-fix versions
- Review agent wallet transaction history for unexpected large payments, token Approve instructions or payments to unfamiliar recipients
Workarounds
- Keep the default $1 spendControls cap enabled and do not set spendControls to false
- Require that SIWx challenge domain and URI match the 402 response origin before signing
- Run facilitators on Solana only with the discriminator-checked @x402/svm
Longer-term hardening
- Set per-payment and total budgets on every agent wallet
- Limit approved tokens, networks and recipients with an allowlist
- Use dedicated low-balance wallets for autonomous agents
- Track dependency versions directly because no npm audit or PyPI advisory exists for these flaws
Weaknesses (CWE) in Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
Timeline of Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
- GitHub advisory GHSA-qr2g-p6q7-w82m published for an earlier, separate x402 SDK Solana facilitator issue (fixed in @x402/svm 2.6.0); not part of these three flaws.
- Separate study reports 31 vulnerabilities across 15 x402 payment facilitators (context for the x402 ecosystem's security posture).
- TypeScript PR #3132 merged, adding the TransferChecked discriminator check to the Solana exact scheme in @x402/svm.
- TypeScript PRs #3124 (default $1 spend control) and #3133 (SIWx origin verification) merged.
- x402 Foundation released SDK fixes across TypeScript, Python and Go; @x402/svm 2.23.0 contains the Solana fix.
- V12 Security published findings on three critical x402 SDK flaws, validated with local tests only; no live transactions sent.
- The Hacker News reported the flaws; no CVE, CVSS or public advisory existed, npm audit and PyPI showed no warnings, and latest releases were 2.28.0 (TypeScript, Go) and 2.25.0 (Python).
Sources cited for Critical x402 SDK Flaws Could Let Malicious APIs Drain AI
- Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents' Token Balances
- x402 PR #3124 - default $1 spend control (TypeScript)
- x402 PR #3132 - SVM exact TransferChecked discriminator fix (TypeScript)
- x402 PR #3133 - SIWx challenge origin verification (TypeScript)
- x402 PR #3154 - spend control (Python)
- x402 PR #3156 - spend control (Go)
- x402 PR #3192 - SIWx origin check (Python)
- x402 PR #3193 - SIWx origin check (Go)
- GHSA-qr2g-p6q7-w82m - earlier x402 SDK Solana advisory (separate issue, fixed in @x402/svm 2.6.0)
- GitLab Advisory Database - npm/@x402/svm
- 31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping (related facilitator study)
- Coinbase and 14 other x402 facilitators failed security tests built for the coming AI-agent economy
Detection coverage for TL-2026-4252
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4252 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.