# Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi

## Executive summary

This talk details the x402 protocol, which enables AI agents to make micro-payments on-chain for data and APIs using the HTTP 402 status code. While the protocol allows for autonomous payments, the speaker, Ishween Kaur, demonstrated six critical vulnerabilities in a safe test environment. The core message is that while agents can pay, robust guardrails, shared storage mechanisms, and phased rollout testing (shadow phase) are essential to prevent financial loss and data leakage.

## Key takeaways

- The x402 Protocol Mechanism: x402 utilizes the HTTP 402 status code to signal that payment is required. The process involves four entities (Buyer, Seller, Facilitator, Chain). Payments must be on-chain (e.g., Base, Ethereum) because micro-payments (cents) are too expensive to process via traditional credit card rails. The payment flow requires verification, settlement, and data release.
- Preventing Price Manipulation: Attackers can manipulate the price in the payment header, even if the listed price is lower. The fix requires a code check comparing the listed price against the actual payment requirement in the header.
- Mitigating Double Payments: Since a duplicate payment number is rejected on-chain, an attacker might attempt to release confidential data multiple times using the same payment ID. The fix is implementing shared storage to track all payment numbers (both completed and in progress).
- Securing Data Release (Free Shopping): To prevent data leakage when a payment reverts (e.g., due to insufficient funds), the data release must wait until the settlement phase is confirmed. However, this introduces a trade-off between latency and risk.
- Defending Against Prompt Injection: Agents can be tricked by text suggestions (e.g., 'full version is at premium summary') into initiating unauthorized payments. Effective guards include limiting the agent's actions (e.g., restricting calls to one per turn) rather than relying solely on keyword filters.

## Technical details

- x402 Protocol Flow: The protocol involves the Buyer requesting data, the Seller responding with 402, the Buyer signing the payment, and the Facilitator verifying the signature before settlement and data release.
- Payment Scaling: On-chain payments are necessary for micro-payments (e.g., 1 cent) because the transaction fees of credit cards are disproportionately high for small, high-volume agent transactions.
- Lookalike Seller Defense: To prevent agents from being directed to malicious look-alike sellers, enterprises should implement a combination of an allow list, block list, and a probation list for new, undiscovered sellers.
- Deployment Methodology: Safe rollout requires a 'trace-by-trace' approach. Start by logging the entire sequence diagram using a single Payment ID, moving through a 'shadow phase' (20-25 success/failure datasets) for error analysis, and finally reaching 'enforcement' by adding guards and alerts.

## Practical implications

- Implement shared storage mechanisms to track unique payment IDs to prevent double charges and ensure data integrity across multiple pages.
- Adopt a phased rollout strategy (Shadow $ ightarrow$ Enforcement) and perform error analysis using diverse success and failure datasets.
- Build guardrails into the agent workflow that check payment details (price, seller ID) before the buyer signs the payment.
- For high-value or confidential data, delay data release until the on-chain settlement phase is confirmed, despite potential latency trade-offs.

## Topics

Agentic Payments, Blockchain Security, AI Agent Workflow, Payment Protocols, Cybersecurity, x402 Protocol, Base Sepolia, Llama 3.2

Source: https://www.youtube.com/watch?v=YU1uD_YkpjU