As cited
Copy frozen at (site build).
vulnerabilities
Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances
The x402 software development kit (SDK) contained a flaw that allowed malicious application programming interfaces (APIs) to request payment of an artificial intelligence (AI) agent's entire token balance rather than a limited transaction amount. The vulnerability affected agents that automatically signed payments and existed in the default client until a fix was released on August 18, 2026.
Why it matters: Developers deploying AI agents that use x402 SDKs for autonomous API payments need to verify they have updated to the August 18 release or configured spending limits, as older versions expose their agents' full token reserves to extraction by compromised or malicious API endpoints.
- Source published
- First seen by Cybersecurity Tracker