Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
x402 SDK flaw allows malicious APIs to drain AI agents' full token balances without spending limits.
Run V12?
Get an email when a reviewed story names V12, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Security firm V12 discovered a critical vulnerability in x402 SDKs where the default client imposed no spending limits on API payment requests, potentially allowing malicious APIs to drain an AI agent's entire token balance. The flaw affected agents that automatically signed payments without restrictions. SDK maintainers addressed the issue with spending limit controls added in August 18 releases.
The lesson from this incident
Full lessonThe x402 SDK shipped with no default spending limits, meaning AI agents would automatically approve and sign any payment request made by an API they interacted with — including malicious ones. This is a classic misconfiguration-by-default problem: the secure option (spending caps) existed but was not enforced out of the box, placing the burden of safety entirely on developers who may not have known the risk. In agentic AI systems that operate autonomously and handle real financial assets, unbounded authorization is catastrophic. The incident highlights that SDK developers must ship secure defaults, not secure options, especially when financial transactions are involved.
What helps against this
How we list vendors- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.