x402 Security Flaws Expose a Bigger Risk as AI Agents Start Spending Crypto

The next crypto payments problem may not begin with a person clicking the wrong link. It may begin with software spending money before any person is watching.

That is the larger warning emerging from new security research into x402, an open payment protocol being developed for a future in which websites, APIs, software services and AI agents can exchange value automatically.

Researchers presenting at the 35th USENIX Security Symposium tested 15 major x402 facilitators and found that every one violated at least one security rule defined by the study.

The researchers identified 49 rule violations corresponding to 31 distinct vulnerabilities and grouped the resulting risks into four broad attack classes: free shopping, asset theft, service denial and gas abuse.

Those findings are serious on their own.

The deeper issue is what x402 is being built to enable.

Coinbase describes x402 as infrastructure through which an AI agent can request an API or service, receive a payment requirement, pay automatically with stablecoins and obtain access without a traditional checkout page, card form or human approval step.

That model could remove enormous friction from digital commerce.

It could also remove the person who normally notices when something feels wrong.

The real security question is therefore no longer simply whether a blockchain transaction is valid.

It is whether a machine can safely decide when to authorize, verify, settle and release value at a speed humans cannot realistically supervise transaction by transaction.

The AI-Agent Economy Wants to Remove Humans From Checkout

x402 is designed around an elegant idea.

HTTP already has a status code called 402 Payment Required. The protocol turns that concept into a payment flow for the modern internet.

A client requests a paid resource.

The server responds with payment requirements.

The buyer submits payment authorization.

A facilitator verifies and settles the payment.

The seller then provides the resource.

Coinbase’s official x402 documentation describes this as a way to make payment part of the client-server interaction itself, eliminating the need for separate checkout pages, accounts, subscriptions or billing systems.

The buyer can be a human.

More importantly for the emerging market, the buyer can be software.

Coinbase explicitly markets x402 for AI agents purchasing APIs, data and services autonomously.

Its developer documentation describes agentic accounts that can discover services, pay for them and complete workflows without manual intervention.

That is the technological promise.

Payment becomes another tool an AI agent can use while completing a task.

The security study shows why the same feature creates an entirely new class of financial risk.

Machines Can Scale a Payment Mistake Far Faster Than Humans Can

A conventional payment error usually has natural friction.

A person needs to click something.

A merchant may inspect an order.

A bank may run risk checks.

A buyer may notice an unexpected amount.

A customer may stop before entering card details.

Agentic commerce is intentionally designed to remove many of those steps.

An autonomous agent could potentially buy thousands of API calls, data requests, compute resources or digital services in rapid succession.

If the payment logic is correct, that efficiency is the point.

If the payment logic is wrong, the same efficiency becomes an attack multiplier.

This is what makes the x402 research more consequential than another isolated smart-contract vulnerability report.

The security model is being evaluated before machine-to-machine payments scale into everyday economic activity.

As The Crypto Encounter has previously explained, a technically valid blockchain transaction does not necessarily mean the economic outcome was legitimate or intended.

x402 takes that problem into an automated environment where the decision-maker may itself be software.

All 15 Tested Facilitators Violated at Least One Security Rule

The USENIX research describes the work as the first systematic study of authorization correctness and execution safety across real-world facilitator-mediated x402 deployments.

The researchers evaluated 15 major facilitators collectively used by more than 60,000 sellers and 360,000 buyers.

They developed eight security rules covering the responsibilities of facilitators and then tested live systems using a semi-automated black-box methodology.

Every tested facilitator violated at least one rule.

The researchers mapped those violations into 31 vulnerabilities and four attack families:

• Free shopping: a buyer receives a product or service even though payment never successfully settles.
• Asset theft: flaws potentially expose assets controlled by the facilitator.
• Gas abuse: attackers can force facilitators to pay blockchain fees for expensive or malicious activity.
• Service denial: malformed or adversarial requests can interfere with settlement infrastructure.

The paper directly validated six attack paths under controlled conditions.

That included two free-shopping attacks, three gas-abuse attacks and one path capable of exposing facilitator-controlled assets.

The researchers did not claim that every historical x402 transaction was vulnerable.

That distinction matters.

The study found vulnerabilities across infrastructure representing most of the x402 activity it observed. It did not conclude that 99% of actual payments were exploited or even exploitable in exactly the same way.

The Bigger Risk Is Hidden in the Word “Facilitator”

Crypto’s original pitch was built around removing financial intermediaries.

x402 shows how quickly intermediaries can return when systems need to become convenient.

A facilitator sits between buyers and merchants and handles critical parts of the payment process.

Coinbase says its CDP Facilitator validates signed payments, screens transactions, submits settlements onchain and reports the result back to the seller’s resource server.

That is useful because most merchants do not want to implement signature verification, blockchain settlement, sanctions screening and gas management themselves.

But convenience concentrates responsibility.

A merchant may no longer need to trust a bank or card network.

It still has to trust the facilitator to interpret payment instructions correctly.

That is where the architecture becomes much more interesting.

AI commerce can be decentralized at the blockchain layer while remaining highly dependent on centralized trust at the settlement layer.

That is not automatically a design failure.

It is a trust assumption that users and merchants need to understand.

The same principle appears throughout crypto. Strong cryptography does not automatically make every service built around a blockchain secure.

A Facilitator Can Become a Shared Point of Failure

The concentration becomes more important when one facilitator serves thousands of merchants.

The USENIX researchers found that Coinbase was the largest facilitator during their measurement period, processing tens of millions of transactions and a substantial share of observed payment volume.

More than 93% of roughly 53,500 unique servers observed in the study were associated with a single facilitator.

This changes the potential blast radius of a security flaw.

A weakness inside one small merchant affects one merchant.

A weakness inside shared settlement infrastructure can affect many independent sellers at once.

The web already learned this lesson with cloud computing, content-delivery networks and identity providers.

Centralized infrastructure makes services easier to operate until the shared infrastructure fails.

x402 may be developing a similar dependency inside machine commerce.

The “Free Shopping” Attack Exposes the Most Human Business Problem

One attack class has an unusually simple economic outcome.

The customer receives the product.

The merchant receives nothing.

The researchers call it free shopping.

An x402 payment can pass an initial verification step without successfully completing final settlement onchain.

A payment authorization could expire.

The buyer could lack sufficient funds by settlement time.

The eventual blockchain transaction could fail.

If the merchant releases an irreversible service immediately after preliminary verification, there may be nothing left to recover.

This matters especially for digital goods.

An API response cannot always be taken back.

A data feed may already have been consumed.

A model may already have processed the purchased information.

Compute may already have been used.

A software license may already have been delivered.

An AI agent can therefore obtain real economic value during the gap between verification and final settlement.

This is a machine-commerce version of a problem financial systems have spent decades trying to solve: when is payment final enough for the seller to release the product?

Verification and Settlement Are Not the Same Event

This distinction may be the single most important technical lesson for merchants considering x402.

Verification asks whether the submitted payment authorization appears valid.

Settlement asks whether the money actually moved successfully.

Those are different events.

A merchant that treats successful verification as equivalent to successful payment can expose itself to loss.

Coinbase’s current documentation reflects this issue clearly in its newer checkout guidance.

The company tells developers using Coinbase Business Checkouts to treat the checkout reaching COMPLETED as the source of truth rather than relying simply on the response seen by the AI agent.

That is an important design principle for any automated payment system.

Do not deliver irreversible value merely because the payment looks valid.

Deliver it when settlement reaches the level of finality your business requires.

This principle resembles the broader crypto-security problem discussed in The Blockchain Knows What Happened, Not Whether It Was Fair: technical state and economic fairness are not the same thing.

AI Agents Make Free Shopping More Dangerous Than Human Fraud

A human attacker trying to exploit a payment bug has practical limitations.

They need time.

They need to make requests.

They may need to repeat actions manually.

An automated agent can scale the process.

If a weakness allows an unpaid API call, an attacker does not need to steal one API call.

Software can attempt thousands.

If a merchant sells data for fractions of a dollar, a human may barely notice the opportunity.

A bot can aggregate tiny failures into meaningful losses.

This is why micropayments can create unusual security economics.

Individually insignificant transactions can become expensive when repeated at machine speed.

Gas Sponsorship Creates Another Asymmetry

Facilitators can also make x402 more convenient by sponsoring blockchain transaction fees.

The merchant or buyer does not necessarily need to manage gas for every payment.

That convenience shifts cost to the facilitator.

The researchers found multiple ways attackers could potentially exploit this arrangement.

Three directly validated attack paths involved gas abuse.

Malicious requests could cause vulnerable facilitators to fund expensive smart-contract deployment or initialization activity.

The attacker gains the ability to consume network resources while someone else pays the bill.

This creates a classic economic-security problem.

If an operation costs the attacker almost nothing but costs the defender money each time, automation heavily favors the attacker.

A bot can repeat the request until rate limits, balances or infrastructure stop it.

Researchers Found $202,000 in Historical Network Fees

The study also examined the economic footprint of real x402 settlement activity.

Researchers analyzed more than 119 million transactions across Base and Solana during the measurement period.

Facilitators spent roughly $202,000 in network fees.

About $5,800 of those costs were associated with Base transactions that reverted or failed.

The researchers did not claim those historical failures were malicious attacks.

That would go beyond the evidence.

The data is important for a different reason.

It proves the economic asymmetry already exists in normal operation.

The facilitator can spend real money even when settlement does not complete.

If attackers can deliberately trigger that same condition repeatedly, normal operating friction becomes a denial-of-wallet attack.

The Most Severe Attack Could Expose Facilitator-Controlled Assets

The most serious path described by the researchers involved ERC-6492.

ERC-6492 is designed to support signatures associated with smart-contract wallets that may not yet have been deployed.

That flexibility introduces complexity.

The researchers found that malicious metadata could potentially cause a facilitator to fund and submit an arbitrary token-approval transaction instead of the payment operation it expected to perform.

The researchers stopped before actually moving facilitator-held assets.

They nevertheless classified the flaw as a direct asset-theft path because an attacker could potentially use the approval authority to create access to assets controlled by the facilitator.

The scenario reinforces a recurring lesson in crypto security.

The dangerous transaction does not always look like a transfer.

Sometimes the attacker wants permission.

The Crypto Encounter has explored the same mechanism from the ordinary wallet user’s perspective in The Token Approval You Forgot Can Drain You Later. A token approval can create future spending authority without transferring the asset immediately.

In an x402 facilitator, the stakes are different because the potentially exposed assets belong to shared infrastructure rather than one retail wallet.

This Is Not Evidence That Coinbase Lost Customer Funds

The findings require careful interpretation.

The research does not establish that Coinbase or every other tested facilitator has suffered asset theft through these attack paths.

It does not show that all current x402 deployments remain vulnerable today.

It does not prove the 119 million historical transactions analyzed by the researchers were malicious.

Several providers began remediation after disclosure.

The paper states that Coinbase, PayAI and Mogami had confirmed multiple vulnerabilities and that fixes had begun for some issues.

The researchers also did not publicly map every vulnerability to every individual facilitator.

That protects disclosure processes but limits what outsiders can conclude about each provider’s current production exposure.

For readers, the appropriate conclusion is narrower:

The first large systematic study of x402 found security assumptions that were not consistently enforced across major facilitators.

That matters because the protocol is moving toward much larger economic ambitions.

Coinbase Says x402 Has Already Processed More Than 100 Million Payments

x402 is no longer just a whitepaper concept.

Coinbase’s current developer documentation says its CDP Facilitator has processed more than 100 million x402 payments across Base and Solana.

The company also reports more than $28 million in payment volume through the facilitator.

This level of usage makes the security debate operational rather than theoretical.

Developers are already using the infrastructure.

Agents are already being built to purchase services.

Merchants are already being encouraged to monetize APIs through x402.

The question is whether the risk controls mature as quickly as adoption.

The AI Economy Creates a New Kind of Wallet Holder

Crypto security has traditionally focused on people.

Protect your seed phrase.

Do not click fake links.

Verify the address.

Read the transaction before signing.

Those recommendations assume a person is present.

Agentic payments introduce a wallet controlled or operated by software.

The user may grant an AI agent permission to spend a limited amount of USDC.

The agent then decides when purchases support the task it is trying to complete.

This raises a new set of questions:

• How much is the agent allowed to spend?
• Which merchants can it pay?
• How does it identify fraudulent services?
• What happens when the seller does not deliver?
• Can the payment be reversed?
• Who notices unusual spending?
• How quickly can permissions be revoked?
• Can an attacker manipulate an agent into purchasing unnecessary services?
• Who carries liability when the agent makes the wrong economic decision?

These are not purely technical questions.

They concern authorization, responsibility and financial control.

AI Agents Could Become the Ultimate Social-Engineering Target

Humans fall for phishing because language can influence decisions.

AI agents also make decisions based on information they receive.

That creates a future attack surface extending beyond x402 itself.

A malicious website might not need to trick a person into paying.

It may need to manipulate an agent into believing a paid tool is necessary.

Prompt injection could potentially influence what services an autonomous agent uses.

False metadata could misrepresent prices.

Malicious service discovery could steer agents toward attacker-controlled endpoints.

Permission design could allow an agent to spend more than its owner intended.

x402 does not create all of these problems.

It makes autonomous payment available to software operating inside an environment where these problems can exist.

This is why the wider security architecture matters.

A secure blockchain does not automatically make the AI decision layer secure.

Attackers have historically preferred exploiting the weakest layer around crypto rather than breaking the underlying blockchain. In agentic commerce, the weakest layer may eventually be the AI agent’s reasoning and permissions.

The Payment Layer Needs Spending Limits Designed for Machines

Traditional cards already use spending controls.

Businesses issue employee cards with limits.

Banks flag unusual payments.

Corporate expense systems restrict merchant categories.

AI wallets will need similar concepts adapted to machine behavior.

A safe agentic wallet may need:

• per-transaction limits;
• daily and monthly spending ceilings;
• merchant allowlists;
• service-category restrictions;
• velocity controls;
• automatic suspension after unusual behavior;
• human approval above defined thresholds;
• clear transaction logs;
• revocable permissions; and
• separate wallets for different agents or tasks.

The important design principle is that autonomy does not require unlimited authority.

Machines can act independently within boundaries.

Merchants Need a Different Definition of “Paid”

The USENIX findings also change what merchants should consider successful payment.

A merchant selling an irreversible resource should care about settlement, not simply authorization.

That may require waiting longer.

It may reduce some of the speed advantage x402 promises.

But the alternative is accepting a financial risk the merchant may not understand.

The researchers recommend withholding irreversible services until settlement succeeds or retaining a way to reverse the service if payment later fails.

For some businesses, reversal is possible.

A software account can be disabled.

Future API access can be revoked.

For others, it is impossible.

Once data has been delivered, the merchant cannot make the recipient unknow it.

Machine commerce therefore needs settlement rules matched to the product being sold.

The Audit Lesson Applies Here Too

The x402 research also reinforces a broader security principle.

Infrastructure can be widely adopted, professionally developed and security-reviewed without becoming risk-free.

The Crypto Encounter recently examined why an audit should be treated as evidence of security work rather than a guarantee of safety.

x402 is still evolving.

Implementations change.

SDKs update.

Facilitators patch vulnerabilities.

Merchants may continue running older versions.

This creates a difficult remediation problem.

Fixing the central facilitator may not fix every merchant deployment.

A secure new SDK does not automatically remove an outdated package already running on thousands of servers.

Coinbase Reference Kits Show Why Merchant Software Matters

The USENIX study did not limit its analysis to facilitator infrastructure.

Researchers also examined reference server kits provided to developers.

They found that all seven Coinbase reference server kits they examined lacked explicit mechanisms for reversing merchant actions after successful verification.

Earlier versions of a Coinbase Flask kit could reportedly release protected resources after verification even if settlement later failed.

This is an important example of how developer tooling can shape ecosystem risk.

Most businesses will not build a payment stack from scratch.

They copy examples.

They install SDKs.

They use recommended patterns.

A security assumption inside reference code can therefore spread much faster than a vulnerability in one custom application.

Open Protocol Does Not Mean Uniform Security

x402 is open and permissionless.

Coinbase’s documentation notes that anyone can operate a facilitator.

That supports competition and reduces dependence on one provider.

It also means different facilitators can make different implementation choices.

Security quality can vary.

One provider may strictly validate settlement parameters.

Another may sponsor gas aggressively.

A third may interpret the same metadata differently.

Open standards create interoperability.

They do not automatically create uniform implementation security.

The AI-Agent Economy May Need Payment Reputation

Human commerce depends heavily on reputation.

Consumers recognize brands.

Credit-card networks monitor merchants.

App stores review applications.

Businesses establish trading histories.

An AI agent purchasing thousands of unknown digital services may need an equivalent trust system.

The agent must somehow answer:

Is this service legitimate?

Has it delivered reliably before?

Does the price make sense?

Is this facilitator trustworthy?

Are refund or dispute mechanisms available?

Without reputation, automated discovery can turn open markets into automated attack surfaces.

This is especially relevant to stablecoin payments because settlement can be fast and difficult to reverse.

What Happens When No Human Notices the First $1 Loss?

Machine commerce changes another psychological feature of fraud.

Humans notice pain.

A person sees an unexpected $20 charge and asks why it happened.

An agent does not experience financial discomfort.

It follows rules.

If a bug causes an agent to overspend $1 repeatedly, the first transaction may look irrelevant.

Ten thousand transactions later, the loss is not irrelevant.

This means anomaly detection becomes essential.

The system needs to recognize unusual economic behavior without waiting for a human to complain.

Blockchain Finality Makes Automated Errors Harder to Repair

Machine-speed payments also collide with one of crypto’s defining properties.

Confirmed blockchain transfers are generally difficult to reverse.

That characteristic provides strong settlement finality.

It also reduces the room for error.

The Crypto Encounter’s guide to irreversible crypto transactions explains why there is usually no central authority capable of simply undoing a completed blockchain payment.

With human transactions, users can reduce that risk by slowing down.

AI commerce is being designed specifically to speed up.

That tension will need to be resolved through controls before payment rather than rescue after payment.

The Problem Is Liability as Much as Cybersecurity

The x402 vulnerabilities raise another question the technology alone cannot answer.

Who pays when something goes wrong?

If a merchant delivers a service after verification but settlement fails, should the merchant absorb the loss?

If a facilitator sponsors attacker-induced gas, is that simply an operational expense?

If malicious metadata causes unauthorized asset approval, who bears responsibility?

If an AI agent makes a legitimate but economically irrational purchase, does responsibility belong to the agent developer, wallet provider or user?

Existing consumer-payment systems developed chargebacks, fraud departments, card-network rules and liability frameworks partly because payment disputes are inevitable.

Agentic crypto payments are attempting to create a different model.

The technology may settle instantly.

Economic responsibility still has to land somewhere.

This Is Why x402 Security Matters Beyond Coinbase

Coinbase is prominent in the research because of its role in building and facilitating x402.

The story is larger than one company.

If machine commerce grows, payment protocols could become foundational internet infrastructure.

AI agents may purchase:

• model inference;
• cloud compute;
• financial data;
• market feeds;
• search results;
• software tools;
• research databases;
• images and media;
• identity services;
• storage;
• bandwidth; and
• other AI-agent services.

A security failure in that layer is not simply a crypto wallet problem.

It becomes an internet-commerce problem.

The Industry Has a Chance to Fix This Before AI Spending Becomes Normal

There is a positive side to the research.

The vulnerabilities were identified while the agentic-payment market is still relatively young.

Providers have time to improve implementation standards before autonomous payments become routine across millions of businesses.

The researchers recommend several concrete safeguards.

• Treat all client-provided transaction fields as untrusted.
• Revalidate payment conditions immediately before settlement.
• Place strict limits on facilitator-sponsored gas.
• Do not release irreversible services before settlement succeeds.
• Maintain compensating mechanisms where service reversal is possible.
• Update SDKs and reference implementations consistently.
• Monitor failed settlement attempts for abuse patterns.

These are not exotic security ideas.

They are basic risk controls adapted to a new payment environment.

The Crypto Encounter Take

x402 is trying to solve a real problem.

The internet was built to move information.

It was never particularly good at allowing software to exchange tiny amounts of money automatically.

Stablecoins and AI agents could change that.

But automated commerce cannot simply remove checkout friction and declare the payment problem solved.

The USENIX findings expose the layer that becomes more important when humans disappear from the flow.

Someone still has to decide whether a payment is valid enough to trust.

Someone still pays the network fee.

Someone still releases the product.

Someone still owns the assets used for settlement.

And someone still absorbs the loss when those assumptions fail.

The facilitator has become that someone in many x402 implementations.

That makes facilitators valuable.

It also makes them critical infrastructure.

The most important x402 question is therefore not whether AI agents can spend crypto.

They already can.

The harder question is whether the financial system around those agents can recognize and contain a bad decision before software repeats it thousands of times.

Agentic payments may ultimately become one of crypto’s strongest real-world use cases.

Before that happens, the industry has to solve a problem humans have always understood instinctively:

Speed is useful only when the money is going where it was supposed to go.

Frequently Asked Questions

What is x402?

x402 is an open payment protocol that extends the HTTP 402 Payment Required concept to allow websites, APIs, software and AI agents to request and complete payments as part of a normal internet request. It is designed to support machine-to-machine and human-to-machine payments without conventional checkout flows.

Why is x402 important for AI agents?

x402 allows an AI agent to pay for APIs, data, compute or other digital services automatically while completing a task. This could allow software to participate directly in economic activity without requiring a human to approve every individual purchase.

What did the USENIX x402 security study find?

Researchers tested 15 major x402 facilitators and found that all violated at least one of eight security rules defined in the study. They identified 49 rule violations corresponding to 31 vulnerabilities across four attack categories: free shopping, asset theft, gas abuse and service denial.

Does the research mean every x402 transaction is vulnerable?

No. The researchers examined facilitators representing a very large share of observed x402 activity, but they did not conclude that every transaction processed through those systems was exploitable. The study identified vulnerabilities and attack paths in implementations rather than proving that all historical payments were compromised.

What is an x402 facilitator?

A facilitator is infrastructure that helps merchants verify signed payment authorizations and submit settlements to supported blockchains. Facilitators can also handle transaction screening and network-fee management, reducing the amount of blockchain infrastructure merchants need to operate themselves.

What is a free-shopping attack?

A free-shopping attack occurs when a merchant releases a product or irreversible digital service after payment verification but before final settlement. If the blockchain settlement later fails, the buyer may keep the service without successfully paying for it.

What is gas abuse in x402?

Gas abuse occurs when an attacker causes a facilitator that sponsors blockchain transaction fees to pay for unnecessary, expensive or malicious transactions. Repeating such requests could create direct financial losses for the facilitator.

Did researchers steal funds from Coinbase or other facilitators?

No. The researchers validated attack paths under bounded conditions and stopped short of moving facilitator-controlled assets. The paper identifies a potential asset-theft path but does not report that researchers stole provider funds.

Has Coinbase fixed the vulnerabilities?

The research states that Coinbase and some other providers confirmed vulnerabilities and began remediation. However, the public research does not map every vulnerability to every facilitator or establish that every merchant deployment and older SDK version has been updated.

Why does AI make payment security harder?

AI agents can act much faster than humans and may execute many transactions autonomously. A small payment flaw that would create one human error could potentially be repeated thousands of times by automated software. This increases the importance of spending limits, settlement checks, anomaly detection and revocable permissions.

Can autonomous AI agents already pay with crypto?

Yes. Coinbase’s x402 and agentic-wallet documentation describes systems that allow AI agents to discover and pay for services automatically using stablecoins such as USDC across supported blockchain networks.

What should merchants using x402 do to reduce risk?

Merchants should use current SDKs, verify settlement rather than relying solely on preliminary authorization, delay irreversible delivery until payment reaches the required finality, monitor failed settlements and follow facilitator security guidance. Businesses should also evaluate whether their product can be revoked if a payment fails.

What is the biggest long-term risk from agentic crypto payments?

The biggest structural risk is that financial decisions can occur at machine speed without human review. If authorization, facilitator logic or settlement controls fail, losses can scale much faster than in human-operated commerce. Payment infrastructure therefore needs automated safeguards capable of operating at the same speed as the agents using it.

Disclaimer

This article is for informational and educational purposes only and does not constitute financial, investment, cybersecurity, legal or technical advice. x402 and agentic-payment infrastructure continue to evolve, and implementations may change as vulnerabilities are patched and standards develop. Businesses considering autonomous crypto payments should conduct independent technical and security reviews before deploying systems that handle funds or irreversible services.