x402 SDKs: Critical flaws let malicious APIs drain AI agents' token balances, bypass Solana payments, and relay login signatures (no CVEs assigned)
Severity: critical · Patch status: patched · Since 2026-10-22
Security firm V12 disclosed three critical flaws in the x402 payment SDKs used by AI agents to pay for API calls. The default client set no spending limit, letting a malicious API request an agent's full token balance; the TypeScript Solana facilitator accepted token approvals (moving no tokens) as valid payments, enabling complete payment bypass; and the SIWx sign-in client signed login messages without verifying the destination site, enabling relayed authentication. All three were fixed in August 18 releases (2.23.0+), which add $1-per-payment caps, stablecoin-only defaults, instruction-type checks, and domain verification. No attacks reported, but npm/PyPI audits give no warning to upgrade. Latest versions: 2.28.0 (TypeScript/Go), 2.25.0 (Python).
What to do
- Upgrade @x402/fetch, @x402/axios, @x402/extensions, @x402/svm to 2.23.0+ (latest 2.28.0); Python to 2.25.0; Go to v2.28.0
- If unable to upgrade, register a payment policy (registerPolicy / register_policy max_amount) that drops payment options above a set amount
- Do not pass spendControls: false; review any apps that disable spend controls
- Verify SIWx login messages identify the site being contacted before signing
- Audit agent wallets for unexpected balance drains or unauthorized approvals
Fixed versions
- @x402/core, @x402/svm, @x402/extensions, @x402/fetch, @x402/axios 2.28.0
- Go v2.28.0
- Python 2.25.0
- minimum 2.23.0 for the three critical fixes
Sources
All live incidents on Threat Watch