x402 lets software, including AI agents, pay for an API call inside the HTTP exchange: the server answers 402 Payment Required, and the client signs a payment and retries. Security firm V12 reviewed the code and on Oct 22 published three critical findings, reported Aug 12 and, by V12's account, fixed by Aug 20:

• No spending limit by default: the documented client took the server's first payment option and signed whatever amount, token and recipient it named. With an auto-signer and no app policy, one hostile response could get a signature for the wallet's full balance of a supported token.
• Solana payment bypass (TypeScript facilitator only): a token approval, which moves no funds, was accepted as a valid transfer, so a merchant could deliver paid content for free while paying the fee.
• Sign-In-With-X relay: the client signed login messages without checking that the site named in them was the site it had contacted, so a malicious server could relay another site's challenge and log in there as the agent's wallet.

Per The Hacker News, the fixed TypeScript packages are 2.23.0+ of @x402/fetch/@x402/axios, @x402/extensions and @x402/svm. Clients now default to a $1 per-payment cap and recognized stablecoins, unless an app passes spendControls: false. The changelogs don't flag these as security fixes, so npm audit won't warn you. Separately, CVE-2026-113603 (CVSS 6.9, Oct 20) lets a client pay for the cheapest SIWx route and unlock a pricier one, in @x402/extensions up to 2.28.0, the Python package up to 2.25.0 and the Go module up to 2.28.0.

For agent builders: set explicit per-payment and total budgets plus token, network and recipient allowlists. Never run an auto-signing wallet with default policy.