importantSYS.SOURCE: The Hacker News• 2026-10-23T14:05:45+05:30

Critical x402 SDK Vulnerability Allows Malicious APIs to Drain AI Agents' Token Balances

#ai #sdk #vulnerability #api #token

A critical vulnerability in the x402 SDK allows malicious APIs to drain AI agents' token balances by exploiting the default client's lack of spending limits. The issue was addressed in an August 18 release, but remained a risk for agents with automatic payment signing.

AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm V12 said on October 22.

The cause was the SDKs' default client, which set no spending limit until releases on August 18 added one. The risk was limited to agents who automatically signed payments and whose apps set

Read original article

*** END OF TRANSMISSION ***

> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK> QUEST DIAGNOSTICS CONFIRMS CYBERATTACK LEADING TO PATIENT DATA BREACH > EMUDHRA'S PRIVATE KEY COMPROMISE OF INTERMEDIATE CERTIFICATES AND MOZILLA ROOT INVESTIGATION DEADLINE OMISSION > LARGE-SCALE CYBERATTACK EXPLOITS ENTERPRISE FIREWALLS AND VPNS, LEAKING 70,000 CREDENTIALS > INVESTOR-OWNED UTILITIES CHARGE 23% MORE FOR ELECTRICITY THAN PUBLIC PROVIDERS > SHITTER: A PRIVACY-FOCUSED NITTER FORK FOR ALTERNATIVE TWITTER ACCESS > OPENSSL 4.1.0 RELEASE: ENHANCED CRYPTOGRAPHIC FEATURES AND PLATFORM SUPPORT > AI-GENERATED WIKI OF ENRON EMAILS WITH SOURCE CITATIONS > SWEDISH GOVERNMENT OFFICES PROHIBIT USE OF CHATGPT AND CLAUDE AI MODELS > PHP IDENTIFIES UNPATCHED RCE VULNERABILITY CVE-2026-115560 AMID RECENT SECURITY UPDATES > RUSSIAN STATE-SPONSORED HACKERS EXPLOIT MESH NETWORK BACKDOOR IN UKRAINE CYBERATTACK