Security flaws across major x402 payment facilitators could expose facilitator-held assets and leave merchants without payment, according to research presented at the 35th USENIX Security Symposium on Aug. 13, 2026. The study examined 15 major facilitators, including Coinbase, Thirdweb, PayAI and Mogami, and found every platform violated at least one security rule. Researchers mapped 49 rule violations to 31 distinct vulnerabilities across systems accounting for 99% of observed x402 transactions and 98% of payment volume during the study window.
The researchers identified four broad attack classes: free shopping, asset theft, service disruption, and gas abuse. They directly validated six attack paths under bounded conditions, including two free-shopping attacks, three gas-abuse attacks, and one path that could expose facilitator-held assets. The most severe path involved ERC-6492, an Ethereum signature standard for smart-contract wallets. Malicious metadata could cause a facilitator to fund and submit an arbitrary token-approval transaction instead of the intended payment, creating a direct path to asset theft, although researchers stopped short of moving facilitator funds.
Researchers analyzed more than 119 million x402 transactions across Base and Solana between Oct. 1 and Dec. 26, 2025. Facilitators spent about $202,000 on network fees, including roughly $5,800 on failed or reverted Base transactions. The asymmetry means facilitators can incur blockchain costs even when payments never complete. All seven official Coinbase reference server kits examined lacked explicit mechanisms for reversing actions taken after verification, potentially allowing buyers to receive irreversible services before settlement finalizes.
Coinbase was the largest facilitator by a wide margin, processing 77.17 million transactions and nearly $27 million in payment volume. More than 93% of roughly 53,500 unique merchant servers observed were associated with one facilitator. Some remediation is underway: Coinbase, PayAI and Mogami had collectively confirmed six vulnerabilities as of Feb. 6, but it remains unclear how widely fixes have reached production systems.
In a related legal discussion, Brickken CEO Edwin Mata said liability must follow the authority granted to software rather than attach to the AI itself. AI is not a legal person capable of assuming duties or bearing liability, he said. Principals normally bear outcomes when agents act within an authorized mandate, but developers, platforms or institutions could face claims if faulty design or controls let an agent exceed its limits.
Mata pointed to ERC-8226, a proposed Regulated Agent Mandate Standard filed on April 12, as a model for making delegated authority verifiable. It would let a principal give an onchain agent permission limited by asset, action, duration and monetary value. A May Keyrock report found AI agents settled $73 million through 176 million transactions in the previous 12 months, with USDC accounting for 98.6% of payments examined. By July, Chainalysis had counted more than 100 million x402-linked payments on Base. U.S. rules such as SEC Rule 15c3-5 already place risk-control duties on broker-dealers, while Bank of England Deputy Governor Sarah Breeden has said regulators are considering circuit breakers or market-wide kill switches for faulty AI models.
