---
title: Agent payments: V12 found 25 flaws in the x402 SDKs. Default clients set no spending limit, so a hostile API could ask an agent to sign away its full token balance | ctxsec
url: https://ctxsec.com/items/x402-sdk-v12-three-critical-agent-payment-flaws
description: ""
status: "confirmed research (V12 blog, Oct 22; fixes shipped in August; no attacks reported; no x402 security advisories published for these three)"
published: 2026-10-23
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/x402-sdk-v12-three-critical-agent-payment-flaws.md)

confirmed research (V12 blog, Oct 22; fixes shipped in August; no attacks reported; no x402 security advisories published for these three)

2026-10-23

### Agent payments: V12 found 25 flaws in the x402 SDKs. Default clients set no spending limit, so a hostile API could ask an agent to sign away its full token balance

x402 lets software, including AI agents, pay for an API call inside the HTTP exchange: the server answers `402 Payment Required`, and the client signs a payment and retries. Security firm **V12** reviewed the code and on **Oct 22** published three critical findings, reported Aug 12 and, by V12's account, fixed by Aug 20:

- **No spending limit by default:** the documented client took the server's first payment option and signed whatever amount, token and recipient it named. With an auto-signer and no app policy, one hostile response could get a signature for the wallet's full balance of a supported token.
- **Solana payment bypass** (TypeScript facilitator only): a token _approval_, which moves no funds, was accepted as a valid transfer, so a merchant could deliver paid content for free while paying the fee.
- **Sign-In-With-X relay:** the client signed login messages without checking that the site named in them was the site it had contacted, so a malicious server could relay another site's challenge and log in there as the agent's wallet.

Per The Hacker News, the fixed TypeScript packages are 2.23.0+ of `@x402/fetch`/`@x402/axios`, `@x402/extensions` and `@x402/svm`. Clients now default to a $1 per-payment cap and recognized stablecoins, unless an app passes `spendControls: false`. The changelogs don't flag these as security fixes, so `npm audit` won't warn you. Separately, **CVE-2026-113603** (CVSS 6.9, Oct 20) lets a client pay for the cheapest SIWx route and unlock a pricier one, in `@x402/extensions` up to 2.28.0, the Python package up to 2.25.0 and the Go module up to 2.28.0.

**For agent builders:** set explicit per-payment and total budgets plus token, network and recipient allowlists. Never run an auto-signing wallet with default policy.

Sources: [V12: 25 vulnerabilities in the x402 protocol, inside three critical findings (Oct 22)](https://v12.sh/blog/x402) · [CVE-2026-113603: x402 SIWX authorization bypass](https://www.cve.org/CVERecord?id=CVE-2026-113603) · [x402 issue #3838 (SIWX settle hook records client-supplied resource URL)](https://github.com/x402-foundation/x402/issues/3838) · [The Hacker News: Critical x402 SDK flaw could let malicious APIs drain AI agents' token balances (Oct 23)](https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html)