# Critical x402 SDK Flaws Could Let Malicious APIs Drain AI Agents' Token Balances (No Default Spend Limit, Solana Approval-as-Payment, Unverified SIWx Domain)

> V12 Security reported three critical flaws in the x402 Foundation SDKs (originally created by Coinbase) that could let a malicious paid API drain an AI agent's token balance, bypass payment on Solana, or harvest login signatures for unrelated sites. Fixes shipped 2026-08-18; no CVE or CVSS was assigned and no in-the-wild attacks have been reported.

- **Published:** 2026-10-23T09:57:48Z
- **Last reviewed:** 2026-10-23T09:57:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4252
- **ID:** TL-2026-4252
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

x402 is an HTTP-native payment protocol in which a server answers with HTTP 402 Payment Required and the client (frequently an autonomous AI agent) signs a stablecoin payment, typically USDC, and retries the request. The x402 Foundation (a Linux Foundation project; Coinbase created x402 and holds a technical steering committee seat) maintains TypeScript, Python and Go SDKs. V12 Security reviewed the code and validated its findings with local tests only; it sent no live transactions. V12 reportedly identified 25 flaws in total and published details of the three it rated critical.

Flaw 1 - no default spending limit (TypeScript, Python, Go clients). Before the 2026-08-18 releases the default client applied no spending cap. A malicious or compromised API could return a 402 response demanding an arbitrarily large amount in any token, and an agent using the default client would sign it, draining the wallet balance. The fix (TypeScript PR #3124, merged 2026-08-13, with Python #3154 and Go #3156) adds a default cap of $1 USD per payment on recognized pegged assets (stablecoins such as USDC). Non-default assets need explicit opt-in via an allowedAssets list, and the spendControls option can adjust or disable the cap.

Flaw 2 - token approval accepted as payment (Solana, TypeScript only). In @x402/svm 2.0.0-2.22.0 the exact-scheme static validation checked that the instruction at index 2 belonged to the SPL token program but did not check the instruction discriminator. A token Approve instruction, which moves zero tokens, therefore passed as a valid payment, giving a complete payment bypass on the facilitator side. The fix (PR #3132, merged 2026-08-12) adds an explicit data[0] === 12 (TransferChecked) guard, bringing TypeScript in line with the Python and Go implementations, which already had the check. Fixed in @x402/svm 2.23.0 and later.

Flaw 3 - login messages signed without domain verification (SIWx; TypeScript, Python, Go). The automated client signed Sign-In-With-X challenges without confirming that the domain in the message matched the site it was contacting. A malicious API could relay a challenge for an unrelated website and obtain a valid wallet signature for a login there. The fix (TypeScript PR #3133, merged 2026-08-13, with Python #3192 and Go #3193) requires the challenge domain, URI and resources to match the origin of the 402 response URL, and aborts without signing or paying on mismatch. The specification was updated with the SIWx requirement.

Affected: @x402/core, @x402/svm, @x402/extensions, @x402/fetch and @x402/axios 2.0.0-2.22.0 (all fetch/axios/extensions/core releases before the 2026-08-18 fixes), plus the Go module and Python package before the 2026-08-18 releases. Latest versions as of 2026-10-23 are 2.28.0 (TypeScript and Go) and 2.25.0 (Python). As of 2026-10-23 no public security advisory had been published for these three flaws and npm audit and PyPI showed no warnings, so defenders must track versions themselves. V12 also noted a separate payment bypass in @x402/core 2.27.0 (September 2026). V12 recommends that clients check SIWx login messages, set per-payment and total budgets, and limit approved tokens, networks and recipients. Neither V12 nor the x402 Foundation has reported exploitation. Related but separate: GHSA-qr2g-p6q7-w82m (March 2026) covered an earlier Solana facilitator issue fixed in @x402/svm 2.6.0, and a July 2026 study reported 31 vulnerabilities across 15 x402 facilitators; neither should be conflated with the flaws described here.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1199 Trusted Relationship
- T1550 Use Alternate Authentication Material
- T1036 Masquerading
- T1657 Financial Theft

## Sources

- [Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents' Token Balances](https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html)
- [x402 PR #3124 - default $1 spend control (TypeScript)](https://github.com/x402-foundation/x402/pull/3124)
- [x402 PR #3132 - SVM exact TransferChecked discriminator fix (TypeScript)](https://github.com/x402-foundation/x402/pull/3132)
- [x402 PR #3133 - SIWx challenge origin verification (TypeScript)](https://github.com/x402-foundation/x402/pull/3133)
- [x402 PR #3154 - spend control (Python)](https://github.com/x402-foundation/x402/pull/3154)
- [x402 PR #3156 - spend control (Go)](https://github.com/x402-foundation/x402/pull/3156)
- [x402 PR #3192 - SIWx origin check (Python)](https://github.com/x402-foundation/x402/pull/3192)
- [x402 PR #3193 - SIWx origin check (Go)](https://github.com/x402-foundation/x402/pull/3193)
- [GHSA-qr2g-p6q7-w82m - earlier x402 SDK Solana advisory (separate issue, fixed in @x402/svm 2.6.0)](https://github.com/advisories/GHSA-qr2g-p6q7-w82m)
- [GitLab Advisory Database - npm/@x402/svm](https://advisories.gitlab.com/pkg/npm/@x402/svm)
- [31 newly discovered vulnerabilities expose 99% of x402 crypto payments to asset theft and free shopping (related facilitator study)](https://cryptoslate.com/31-newly-discovered-vulnerabilities-expose-99-of-x402-crypto-payments-to-asset-theft-and-free-shopping/)
- [Coinbase and 14 other x402 facilitators failed security tests built for the coming AI-agent economy](https://cryptoslate.com/coinbase-and-14-other-x402-facilitators-failed-security-tests-built-for-the-coming-ai-agent-economy/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4252