x402 Micropayment SDK Had Three Critical Flaws That Could Drain AI Agent Wallets, Now Patched

Security researchers at V12 have disclosed three critical vulnerabilities in the x402 SDK, a micropayment protocol used by AI agents to autonomously pay for API calls without storing credentials—all of which have already been patched as of August 18, but were not flagged by standard vulnerability scanning tools. The flaws could have allowed malicious APIs to trick agents into signing away an entire wallet balance, bypass payment verification through fabricated Solana transactions, or trick agents into signing login messages intended for other websites.