x402 SDK flaw lets malicious API drain AI agents' tokens

01A single SDK call can empty an agent’s wallet

The x402 SDK, used by many agents to pay for external APIs, shipped a default client that never set a spending cap. When an agent automatically signs a payment request, the SDK will approve the full balance of the supported token unless the developer overrides the limit. The flaw was discovered after a security firm showed that a malicious endpoint could ask the SDK to transfer the entire balance, and the SDK complied without prompting the agent or its owner.

Only agents that enable auto‑signing and that rely on the default client are exposed. The risk is limited to those that run code which automatically calls payment APIs without an explicit spend limit. The vulnerability was patched in August, but any deployment that has not upgraded—or that continues to use a custom wrapper that mirrors the default behavior—remains at risk.

02Agents can be coerced through ordinary inputs

A separate report showed how attackers embed malicious commands in emails, compromised websites, or third‑party plugins. When an AI agent with legitimate permissions parses those inputs, it can be tricked into executing shell commands, exfiltrating files, or deleting data. The attackers do not need to compromise the host; they simply exploit the agent’s trust in its input stream.

Gen Digital’s Agent Trust Hub tackles this problem by adding three layers of defence: (1) verification of the skills or plugins an agent is allowed to run, (2) secure connectivity that enforces an allow‑list for outbound connections, and (3) runtime controls that intercept dangerous actions and require explicit human approval before they proceed.

03Ransomware operators already run autonomous red‑team frameworks

Researchers uncovered an “Autonomous Red Team Kill Chain Framework” called Phantom, which is operated by affiliates of the INC and The Gentlemen ransomware groups. Phantom strings together a series of AI‑driven steps – reconnaissance, credential harvesting, lateral movement and data encryption – all coordinated by autonomous agents that act without direct human oversight.

The framework demonstrates that threat actors can scale intrusions by delegating repetitive, low‑level tasks to AI agents. Each agent runs inside its own environment, calls APIs for password spraying, and writes encrypted payloads to compromised hosts. The speed and modularity of the system make it hard for defenders to detect a single point of failure.

04Open standards help but don’t replace runtime enforcement

Anthropic recently donated its Agent Skills specification to the Agentic AI Foundation, a Linux‑Foundation project co‑founded with Block and OpenAI. The move aims to make skill definitions vendor‑neutral and community‑driven, encouraging interoperability across different model providers.

While a shared description language reduces the chance of accidental mis‑behaviour, it does not stop a malicious skill from being executed once it is loaded. Runtime policies, network allow‑lists and auditability are still required to ensure that an agent cannot perform an operation that the operator never intended.

05Hardening your agents with a zero‑trust sandbox today

The most reliable way to protect against the three attack families above is to run every agent inside an isolated microVM that enforces strict egress rules, blocks access to host‑level secrets, and records every action in an immutable log. Before a risky operation, take a checkpoint; after the operation, either rewind to the previous state or keep the successful branch and discard the rest.

Combine the sandbox with a two‑person approval flow for any payment or file‑system write that exceeds a predefined threshold. Verify the audit trail after each run and only promote checkpoints that have passed all policy checks.

• Create a sealed sandbox with an explicit egress allow‑list, e.g. kosa8 sandbox create sealed --egress-allow api.anthropic.com.
• Take a checkpoint before any payment request: kosa8 checkpoint sealed --label "before payment".
• If the payment is not approved, rewind: kosa8 rewind sealed.
• Fork the sandbox to test alternative strategies in parallel: kosa8 fork api -n 8.
• Run kosa8 audit verify daily to ensure the log has not been tampered with.