x402 SDK Flaw

x402 SDK

Malicious APIs could drain AI agents' token balances due to a flaw in the x402 SDKs

Do this now

Avoid calling untrusted APIs with x402 SDKs and limit agent token balances until a fix is available.

First seen: 23 Oct 2026
Last update: 23 Oct 2026, 10:17 UTC
Source: news
On the menu as: Crypto wallets
npm packages

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## x402 SDK Flaw
Severity: unknown. Patch status: no fix yet.
Affected: x402 SDK

Malicious APIs could drain AI agents' token balances due to a flaw in the x402 SDKs

## Steps
1. Search the repo, its CI and infra config for x402 SDK. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: Malicious APIs could drain AI agents' token balances due to a flaw in the x402 SDKs

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html
https://pwned.coffee/i/x402-sdk-flaw

Timeline

23 Oct 2026, 10:17 UTC
Third zero-day exploit in four months
23 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Score: No CVSS published yet: severity unknown.
Last checked: 24 Oct 2026, 17:17 UTC

Sources: KEV – CVE record – Vendor –

Sources

feeds.feedburner.com: Critical x402 SDK Flaw Could Let Malicious APIs Drain AI Agents’ Token Balances

Totalone coffee