Every major payment platform tested for AI agent commerce has security vulnerabilities that could let merchants go unpaid, expose platform assets, or drain transaction fees. Researchers at the 35th USENIX Security Symposium tested 15 x402 payment facilitators, including Coinbase, Thirdweb, PayAI, and Mogami, and discovered that all 15 violated at least one security rule.

The x402 protocol is designed to let artificial intelligence agents autonomously request and complete payments on websites and APIs. As AI agents become more capable, this infrastructure is expected to power trillions of dollars in machine-driven commerce. But the security gaps researchers uncovered suggest the ecosystem is not ready for that scale.

What Security Flaws Did Researchers Find?

The research team mapped 49 rule violations to 31 distinct vulnerabilities across systems that handled 99 percent of observed x402 transactions and 98 percent of payment volume during the study period. The vulnerabilities fell into four broad attack categories:

• Free Shopping: Merchants could release services or goods before payment actually settles on the blockchain, allowing buyers to receive products without paying.
• Asset Theft: Attackers could manipulate payment metadata to trick platforms into approving unauthorized token transfers from facilitator-controlled accounts.
• Service Disruption: Malicious actors could force platforms to process expensive blockchain transactions, disrupting payment services.
• Gas Abuse: Attackers could exploit the fact that platforms sponsor blockchain transaction fees, forcing facilitators to pay for expensive operations without compensation.

Researchers directly validated six attack paths under controlled conditions, including two free-shopping attacks, three gas-abuse attacks, and one path that could expose facilitator-held assets. They stopped short of actually stealing funds but classified the flaws as direct paths to financial loss.

How Could These Attacks Harm Merchants and Platforms?

The most severe vulnerability involved ERC-6492, an Ethereum signature standard designed to support smart-contract wallets that haven't been deployed yet. Researchers found that malicious metadata could cause a facilitator to fund and submit an arbitrary token-approval transaction instead of the payment it expected to settle. This could give attackers authority to approve transfers of assets controlled by the facilitator.

Three other validated attacks exploited the economic feature that makes facilitators useful in the first place: they sponsor blockchain transaction fees on behalf of merchants. Attackers could force affected implementations to pay for expensive smart-contract deployment or initialization, shifting potentially unlimited network costs onto the facilitator. Analysis of more than 119 million x402 transactions across Base and Solana between October and December 2025 showed facilitators already spent about $202,000 on network fees, including roughly $5,800 on Base transactions that ultimately failed or reverted.

The free-shopping attacks create the opposite problem. An x402 payment can pass initial verification but still fail when submitted to the blockchain if an authorization expires or the buyer lacks sufficient funds. If a merchant releases an irreversible service immediately after verification, the buyer receives the product even though settlement later fails. Researchers directly validated two free-shopping attack paths and classified another 10 as high risk.

The problem extended beyond individual facilitators to software supplied to merchants. All seven official Coinbase reference server kits examined by the researchers lacked explicit mechanisms for reversing actions taken after successful verification. In versions of Coinbase's Flask kit through 0.2.1, protected resources could be released after verification regardless of whether settlement succeeded.

Why Does Concentration in the Market Make This Worse?

The potential impact of these vulnerabilities is amplified by how concentrated the x402 market is. Coinbase dominated the facilitator landscape during the study period, processing 77.17 million transactions and nearly $27 million in payment volume. More than 93 percent of the roughly 53,500 unique servers observed in the study were associated with a single facilitator.

This concentration means a vulnerability, outage, or flawed software assumption at one large provider can affect thousands of merchants rather than remain isolated to a small implementation. It also makes remediation uneven. Fixing a facilitator's core service may not eliminate exposure if merchants continue running older software development kits or release products before settlement finality.

Steps to Reduce Risk in AI Agent Payment Systems

Researchers recommended a series of safeguards to address the attack paths they identified:

• For Facilitators: Treat all client-provided transaction fields as untrusted, recheck payment conditions immediately before settlement, and impose strict limits on facilitator-sponsored gas costs to prevent attackers from forcing unlimited fee payments.
• For Merchants: Withhold irreversible services until settlement succeeds on the blockchain, or maintain a way to reverse actions when payment fails, ensuring customers cannot receive goods without paying.
• For SDK Developers: Build explicit mechanisms into reference kits that prevent resource release until settlement is confirmed, protecting merchants from free-shopping attacks.

The disclosures have prompted remediation by some of the facilitators examined, though the public record does not show how widely those fixes have been applied to live x402 infrastructure. A remediation update dated February 6 said Coinbase, PayAI, and Mogami had collectively confirmed six vulnerabilities, with some fixed and work continuing on others.

The researchers did not publicly map individual vulnerabilities to specific facilitators, making it difficult to determine which providers were exposed to each attack or how broadly fixes have reached production systems.

What Does This Mean for the Future of AI Commerce?

The timing of these findings is critical. McKinsey has estimated that AI agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030. Circle, a major stablecoin issuer, reported that 900 paid services are available in its agent marketplace, with USDC settling 99.3 percent of agentic payment volume via the x402 protocol. The company is launching its Arc blockchain mainnet on September 16, 2026, designed specifically to host financial activity and agentic commerce.

If these security gaps persist as AI agent commerce scales, the financial losses could be substantial. The effectiveness of the recommended safeguards will depend on whether facilitators, SDK developers, and merchants deploy them consistently across an x402 market whose activity is already concentrated among a small group of providers.