Five ways an x402 payment can go wrong — and which ones you can catch before your agent pays

x402 turns an HTTP 402 Payment Required into something an autonomous agent can actually act on: the server quotes a price, your agent pays in stablecoin, the request goes through. No human in the loop. That is the whole point — and also the whole problem.

The moment a program can move money without you watching, "discovery" and "payment" collapse into a single step. Your agent finds an endpoint and pays it in the same breath. If anything about that endpoint is wrong — the address, the price, the destination — the money is already gone by the time you would have noticed.

There is now a small but real body of work on how this gets exploited. Five Attacks on x402 and A402 (both on arXiv), Halborn's writeup, and AgentLISA's position paper all converge on the same handful of attack vectors. I read through them while building . No service to trust. This is the floor every x402 agent should have, and it's the part I made free and MIT precisely because it shouldn't be behind anyone's API — including mine.

What you cannot catch locally — and where I'll be honest

Vectors 4 and 5 — Sybil discovery and prompt-injection-to-payment — are different in kind. A locally-running function genuinely cannot know that an address belongs to a Sybil cluster, or that an endpoint with a clean-looking history has been quietly draining wallets for a week. That requires reputation data: a graph of who-paid-whom across many agents, accumulated over time. No amount of clever offline code substitutes for it.

And there's a third category the papers above actually spend most of their pages on, which no screening library — lite or hosted — should claim to fix: the protocol- and settlement-layer attacks. Payment replay; the settlement races where a server delivers before payment finalizes (the "paid-but-denied" and "unpaid-service" outcomes the Five Attacks paper centers on); facilitator trust and economic DoS against endpoints. Those live in the x402 spec, the facilitator, and the on-chain settlement path — not in the request your agent is about to sign. Frisk screens the counterparty and the shape of the transaction; it does not, and cannot, repair the protocol underneath it. So this post is deliberately scoped to the vectors a pre-payment check can actually touch — pretending a screening call closes a replay or atomicity hole would be the other half of how agent-payment security gets oversold.

So lite mode is upfront about this: it always reports "low" confidence and it does not claim to detect Sybil attacks. Pretending a local check can catch a reputation problem is how you ship false confidence, which is worse than no check at all.

This is the line between the open-source library and the hosted service — and I'd rather state it plainly than blur it for a pitch. The hosted side of Frisk is where reputation history and threat intelligence would live, and it is early; the part I'm comfortable telling every x402 developer to install today is the deterministic floor above. If you're shipping an agent that pays, start there. The five checks cost you nothing and close the attacks that are actually closeable in your own process.

Takeaways

• Agent payment safety isn't one problem. It's three: structural checks you can do before paying, reputation you have to source from data, and protocol/settlement holes that sit below any screening call. Solve them separately — and don't let a tool for one pretend to cover the others.


• The deterministic floor — payTo-swap detection, spending policy, transport and address sanity — catches three of the five documented x402 attack classes, with no network call and no trust in anyone. Ship it.


• Be skeptical of anything claiming to detect Sybil/reputation attacks with purely local logic. That category needs data, and honesty about the boundary is the whole game.

Frisk is MIT and the lite engine is dependency-free: . Source, threat-model notes, and the (short, readable) check logic are on GitHub. If you're building on x402 and you catch a vector I missed, open an issue — that's exactly the kind of thing this should accrete.

The reputation-backed hosted tier is in early access. If that's the part you need, email [email protected] — but the deterministic floor above is free, MIT, and yours to ship today regardless.

Sources referenced: "Five Attacks on x402" and "A402" (arXiv); Halborn, "x402 Explained: Security Risks and Controls"; AgentLISA x402 security position paper.