Security Flaw in x402 SDK Could Allow APIs to Exhaust AI Agents' Token Funds

Security researchers at V12 have uncovered a vulnerability in the widely used x402 software development kit (SDK) that could enable malicious API providers to drain the entire token balances of AI agents that rely on the SDK for payment processing. The flaw, disclosed on October 22, allows an API call to request payment without any limit, causing the SDK’s default client to approve a transaction that empties the agent's holdings of a supported cryptocurrency token.

The issue stems from the SDK’s default client configuration, which, unless explicitly overridden, imposes no spending cap on outgoing payments. When an AI agent initiates a request to an external API, the SDK automatically signs a payment for the amount specified in the request. If a hostile API deliberately asks for the full balance, the SDK will comply, signing and broadcasting a transaction that transfers all available tokens to the attacker’s address.

V12’s analysis indicates that the vulnerability is not confined to a single token but applies to any token supported by the x402 SDK’s payment module. Developers who have integrated the SDK without customizing the client’s spending limits are particularly exposed. The firm recommends that developers immediately audit their integration and enforce explicit per‑call limits or use custom client instances that define maximum spend thresholds.

The discovery arrives as the ecosystem of autonomous AI agents that monetize their operations through on‑chain payments continues to expand. These agents frequently call third‑party APIs for data, language models, or specialized services, paying for each call with tokens drawn from their own wallets. An unchecked payment flow could not only deplete an agent’s operational funds but also disrupt services that depend on continuous AI interaction, raising concerns for both developers and end users.

While V12 has not disclosed a formal patch, the SDK’s maintainers have been notified and are expected to release an update that either disables the default unlimited‑spending behavior or requires developers to set explicit limits during initialization. In the meantime, security experts advise a defensive approach: audit code for SDK usage, implement strict spending caps, and monitor transaction logs for unexpected large transfers. As the AI and blockchain communities grapple with the implications, the incident underscores the importance of rigorous security reviews for tools that bridge on‑chain finance and AI functionality.