The default x402 SDK client signed payments with no spending cap, draining AI agents’ balances
On October 22, 2026, V12 revealed that the default client of the x402 payment SDKs signed payments with no spending limit, letting a malicious API drain an AI agent’s balance in a single request. The August 18 fixes exist, but they are not flagged as security in npm or PyPI: upgrade and set your own spending caps.