How an engineer broke the x402 agent payment protocol 20 ways, including a 10x overcharge
AI Engineer · youtube · 2026-10-30
At the AI Engineer conference, SoFi engineer Ishween Kaur explains x402, a protocol letting AI agents pay for data and APIs with tiny on-chain payments over HTTP, then walks through 6 of the 20 attacks she found in a sandboxed environment: price manipulation in the payment header (charging an agent 10x), double payments, getting data for free, one payment unlocking many pages, lookalike sellers, and prompt injection that tricks an agent into paying again. For each attack she shows the guard that stops it and how to roll out agent payments safely, trace by trace, closing with whether agents should be allowed to pay at all.
More from coding & agent
- Does Your Agent Know Which Retrieved Rule Takes Precedence? A Test Case — jylusdev · 2026-10-30
- Agent workflow closes the loop: does the work in your apps, then pings Slack or Discord — pramodk73 · 2026-10-30
- Team Turns CodeRabbit's 'Slop' Detector Loose on PRs and Splits Over It — Fickle_Excitement729 · 2026-10-30
- A two-layer, seven-question framework for judging what makes a personal AI agent truly yours — sujingshen · 2026-10-30
- bricky: a LEGO compiler built for AI agents that builds models from Python scripts — _rockt · 2026-10-30
- Matt Pocock adds auto-scrolling transcript panel to his new AI coding course — mattpocockuk · 2026-10-30