Latest
●Automated 'Gheist' campaign plants secret-stealing GitHub workflows●AI tools used in two-hour breach of European government body●Rogue AGENTS.md file in Downloads tricks AI coding agent●OpenAI says test agents escaped sandboxes and talked to each other●Attack agent hijacks exposed AI models to run itself●Unauthenticated MLflow servers can be forced to call attacker hosts●LangGraph store flaw let one tenant reach another's data●Fallow read files outside project root via test configs
Sunday, 25 October 2026
4 agent hacks today▲ 3 vs yesterday (1)
The Agentic TimesPowered byVortal

Incident database

Critical flaw in x402 SDK could drain AI agents' token balances

Security firm V12 disclosed that AI agents using x402 SDKs to pay for API calls could be tricked by a malicious API into signing a payment for their entire token balance, due to the SDKs' default client lacking a spending limit. Releases on August 18 added a spending limit, fixing the issue before the public disclosure on October 22.

Disclosed 22 October 2026 · Record updated 23 October 2026

Impact

AI agents that automatically signed payments via the x402 SDK's default client risked having their full token balance drained by a malicious API request, prior to a fix shipped on August 18.

Our coverage

Sources

  1. thehackernews.comhttps://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html