Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

Security firm V12 found critical flaws in the x402 SDKs used by AI agents for API payments, including a missing spending limit that could let malicious APIs drain token balances. The x402 Foundation fixed these issues in August, but no public advisories or warnings have been issued yet.