Coinbase & x402 Security Flaws: AI-Agent Economy Risk

New research reveals security flaws in major x402 payment facilitators, including Coinbase. These issues could put facilitator-held assets at risk and leave merchants without payment. Researchers tested 15 x402 facilitators and found every platform violated at least one security rule. They identified 49 rule violations, leading to 31 distinct vulnerabilities. These systems handle 99% of observed x402 transactions. The study identified four broad attack classes: free shopping, asset theft, service disruption, and gas abuse. Researchers validated six specific attack paths. One path could expose facilitator funds. For instance, malicious metadata could trick a facilitator into funding an arbitrary token-approval transaction instead of the intended payment. This could lead to asset theft. Other attacks could force facilitators to pay for expensive smart-contract deployments, shifting unbounded network costs onto them. These findings are crucial because x402 is being promoted as infrastructure for machine-driven commerce, where AI agents complete payments autonomously. Facilitators sit between buyers and merchants, checking payment authorizations. This position gives them significant control but also concentrates risk. The bottom line is these vulnerabilities could lead to direct financial loss for merchants, theft of facilitator assets, and disruption of payment services in the growing AI-agent economy.