Your agent now accepts payments. That is your new attack surface

Description and use

<p>The x402 pattern (HTTP 402, pay and retry) is finally letting AI agents pay for APIs without accounts, keys, or human-in-the-loop. That is a good thing for adoption, and a bad thing for everyone who wrote the receiving side. I audit LLM systems for a living, and the payment layer is where I now find the most unreviewed security code, because it was written by people who knew how to build agents but had never owned an attack surface that accepts money.</p> <h2> The threat model nobody writes down </h2> <p>A payment endpoint for agents differs from a normal API in one way that changes everyth

Problem

<p>The x402 pattern (HTTP 402, pay and retry) is finally letting AI agents pay for APIs without accounts, keys, or human-in-the-loop. That is a good thing for adoption, and a bad thing for everyone who wrote the receiving side. I audit LLM systems for a living, and the payment layer is where I now find the most unreviewed security code, because it was written by people who knew how to build agents but had never owned an attack surface that accepts money.</p> <h2> The threat model nobody writes down </h2> <p>A payment endpoint for agents differs from a normal API in one way that changes everyth

Outcome

<p>The x402 pattern (HTTP 402, pay and retry) is finally letting AI agents pay for APIs without accounts, keys, or human-in-the-loop. That is a good thing for adoption, and a bad thing for everyone who wrote the receiving side. I audit LLM systems for a living, and the payment layer is where I now find the most unreviewed security code, because it was written by people who knew how to build agents but had never owned an attack surface that accepts money.</p> <h2> The threat model nobody writes down </h2> <p>A payment endpoint for agents differs from a normal API in one way that changes everyth

Evidence

Your agent now accepts payments. That is your new attack surface

Source