Five Attacks on x402 Agentic Payment Protocol

• URL: http://arxiv.org/abs/2605.11781v1
• Date: Tue, 12 May 2026 08:49:10 GMT
• Title: Five Attacks on x402 Agentic Payment Protocol
• Abstract summary: We analyze x402 and empirically show that it is vulnerable in both design and implementation.<n>We present five concrete attacks that reveal weaknesses in authorization, binding, replay protection, and web-layer handling.<n>Our results show that all five attacks are practical and can cause either unpaid service or paid-but-denied outcomes.
• Score: 4.93108576295077
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The x402 protocol revives the HTTP 402 Payment Required status code to enable web-native micropayments across APIs, content, and agents. It combines synchronous HTTP authorization with asynchronous blockchain settlement and introduces a cross-layer attack surface absent from conventional web and on-chain payments. In this paper, we formally analyze x402 and empirically show that it is vulnerable in both design and implementation. We present five concrete attacks that reveal weaknesses in authorization, binding, replay protection, and web-layer handling, showing that x402 is vulnerable across multiple stages of the payment workflow. We validate these attacks through a reproducible testbed on local chains, Base Sepolia, and live endpoints and further audit three open-source SDKs and endpoints. Our results show that all five attacks are practical and can cause either unpaid service or paid-but-denied outcomes. We also propose practical mitigations.

Related papers

• Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Services [56.0553456562323]
  Most large language model services use stateless defenses, which judge only the current request to refuse harmful tasks.<n>Decomposition attacks exploit this limitation by splitting a harmful task into individually permissible requests and combining their answers.<n>We show that the achievable security and utility tradeoff depends entirely on how benign requests for the same capabilities are grouped.
  arXiv  Detail & Related papers  (2026-08-18T07:26:30Z)
• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• When HTTP 402 Meets the Blockchain: Risks on Emerging x402 Payments [53.795332613020946]
  x402 is an emerging payment protocol for Web APIs and autonomous AI agents.<n>We present the first systematic study of authorization correctness and execution safety in current facilitator-mediated x402 deployments in the wild.<n>We derive four new attack vectors, including Free Shopping, Asset Theft, Service Denial, and Gas Abuse.
  arXiv  Detail & Related papers  (2026-07-21T19:45:13Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Free-Riding in the AI Economy: Demystifying Logic Flaws in x402-Enabled Payment Systems [14.489441237764161]
  We perform the first comprehensive security analysis of the x402 ecosystem.<n>We reveal that current implementations fail to enforce transactional atomicity and context binding.<n>We show that attackers can exploit the synchronization gap to force merchants to subsidize compute costs.
  arXiv  Detail & Related papers  (2026-05-29T08:31:18Z)
• Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering [0.913755431537592]
  We present presidio-hardened-x402, the first open-source that intercepts x402 payment requests before transmission to detect and redact personally identifiable information (PII)<n>To evaluate the PII filter, we construct a labeled synthetic corpus of 2,000 x402 metadata tripleconfigurations spanning seven use-case categories, and run a 42-precision/recall sweep across two detection modes (regex, NLP) and five confidence thresholds.<n>The recommended configuration achieves micro-F1 = 0.894 with precision 0.972, at a p99 latency of 5.73ms - well within the 50ms overhead budget.
  arXiv  Detail & Related papers  (2026-04-13T13:17:12Z)
• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain [6.142057368768942]
  Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests.<n>We present the first systematic study of this attack surface.
  arXiv  Detail & Related papers  (2026-04-09T16:06:41Z)
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition [48.32744727426218]
  LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories.<n>This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness.<n>We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings.
  arXiv  Detail & Related papers  (2026-03-16T14:49:36Z)
• A402: Bridging Web 3.0 Payments and Web 2.0 Services with Atomic Service Channels [14.234772345560645]
  We present A402, a trust-minimized payment architecture that securely binds Web 3.0 payments to Web 2.0 services.<n>A402 incorporates a TEE-based Liquidity Vault that privately manages the lifecycle of ASCs and aggregates their settlements into a single on-chain transaction.<n>Our results show that A402 delivers orders-of-magnitude performance and on-chain cost improvements over x402 while providing trust-minimized security guarantees.
  arXiv  Detail & Related papers  (2026-03-01T16:45:22Z)
• TxRay: Agentic Postmortem of Live Blockchain Attacks [52.658018348998105]
  Within five years, the DeFi ecosystem has lost over 15.75B USD to reported exploits.<n>We present TxRay, a postmortem system that reconstructs live ACT attacks from limited evidence.<n>On 114 incidents from DeFiHackLabs, TxRay produces an expert-aligned root cause and an executable PoC for 105 incidents, achieving 92.11% end-to-end reproduction.
  arXiv  Detail & Related papers  (2026-02-01T16:17:33Z)
• HTTP Request Synchronization Defeats Discrepancy Attacks [6.113912479606383]
  We propose the first comprehensive defense to address this problem, called HTTP Request Synchronization.<n>Our scheme uses standard HTTP extension mechanisms to augment each request with a complete processing history.<n>Using this history, every proxy server can validate that their processing is consistent with all previous hops, eliminating discrepancy attacks.
  arXiv  Detail & Related papers  (2025-10-11T01:42:38Z)
• Cuckoo Attack: Stealthy and Persistent Attacks Against AI-IDE [64.47951172662745]
  Cuckoo Attack is a novel attack that achieves stealthy and persistent command execution by embedding malicious payloads into configuration files.<n>We formalize our attack paradigm into two stages, including initial infection and persistence.<n>We contribute seven actionable checkpoints for vendors to evaluate their product security.
  arXiv  Detail & Related papers  (2025-09-19T04:10:52Z)
• BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systems [62.17474934536671]
  We introduce the first framework to capture offensive and defensive cyber-capabilities in evolving real-world systems.<n>To capture the vulnerability lifecycle, we define three task types: Detect (detecting a new vulnerability), Exploit (exploiting a specific vulnerability), and Patch (patching a specific vulnerability)<n>We evaluate 8 agents: Claude Code, OpenAI Codex CLI with o3-high and o4-mini, and custom agents with o3-high, GPT-4.1, Gemini 2.5 Pro Preview, Claude 3.7 Sonnet Thinking, and DeepSeek-R1.
  arXiv  Detail & Related papers  (2025-05-21T07:44:52Z)
• A Formal Analysis of SCTP: Attack Synthesis and Patch Verification [7.331862211069559]
  We study the security of the SCTP design, taking a rigorous approach rooted in formal methods. We define 4 attacker models - Off-Path, where the attacker is an outsider that can spoof the port and IP of a peer; Evil-Server, where the attacker is a malicious peer; Replay, where an attacker can capture and replay, but not modify, packets; and On-Path, where the attacker controls the channel between peers.
  arXiv  Detail & Related papers  (2024-03-08T20:38:56Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.