x402 SDK flaw could let rogue APIs drain AI agents' balances

AI agents that use the x402 SDKs to pay for API calls could be tricked into signing away their entire balance of a supported token, security firm V12 disclosed on 22 October 2026.

According to V12, the problem lay in the SDKs' default client, which set no spending limit on payments. A malicious API could therefore request a payment for an agent's full balance of a supported token, and the agent's software would sign it. Releases on 18 August added a spending limit, so the issue was already fixed by the time it was made public.

The risk was not universal. V12 said it was limited to agents that automatically signed payments, rather than those that asked a human to approve each transaction, and depended on how the surrounding application was configured. In other words, the flaw was a weakness in a default setting rather than a break in the underlying cryptography or a bug in how payments were verified.

The pattern is a familiar one for anyone following agent security. An autonomous agent is given a capability, in this case the ability to spend money on behalf of its operator, and the software stack around it is expected to constrain how far that capability can go. When the default configuration imposes no ceiling, the only thing standing between an agent and its full balance is the good behaviour of whatever service it is talking to. A service that an agent calls is also a service that can lie to it.

That makes spending limits a basic control rather than an optional extra. Any agent wired up to a wallet is, in effect, trusting third-party APIs to ask only for what they are owed. A cap turns an unbounded loss into a bounded one, and it does so without requiring the agent to work out whether a given counterparty is honest, which is a judgement that automated systems are poorly placed to make.

Users of the x402 SDKs who are still running versions published before the 18 August releases should check whether their deployments rely on the default client. The disclosure does not describe any confirmed cases of the weakness being exploited against real agents, and V12 did not say how the issue was found.

The episode is a reminder that in agentic systems the security boundary is often set by a default value buried in a client library, rather than by anything that looks like a traditional vulnerability. Reviewing those defaults, particularly where money or credentials are involved, is cheaper than discovering them after a balance has gone.