Attack Vectors in Machine-Payable Web

When an agent pays for data via x402, six attack vectors emerge in the payment lifecycle. Each reveals where trust must anchor between buyer and seller in the machine-payable web.

The most immediate risk involves price manipulation. A seller can change payment requirements between the initial 402 response and the agent's submission. Price drifts upward without buyer consent—fraud in a protocol designed for trustless microtransactions.

Double payment attacks exploit request-response timing. An agent might submit valid payment for one request, then face another 402 for identical data. Without idempotency checks, the same resource costs twice as much within seconds.

Data-for-free scenarios undermine the entire model. Some agents lack validation logic and return the paid resource even without settlement confirmation. The payment occurs but the seller gets no compensation—paradoxical for a protocol named "Payment Required."

One payment unlocking multiple resources creates systemic leakage. A single 402 response can contain access tokens that unlock adjacent pages or datasets. The agent pays once but consumes beyond the original scope.

Lookalike sellers exploit endpoint confusion. Identical data endpoints from different domains can return the same 402 payload. Without proper certificate validation, agents pay impostors for legitimate services.

Prompt injection remains the most insidious. An agent's prompts can include malicious instructions to pay repeatedly for identical resources. The attack bypasses the protocol's efficiency by targeting the agent's decision logic directly.

Each attack vector has corresponding defenses: cryptographic proof of original price requirements, idempotency tokens, settlement verification before data delivery, scoped access tokens, certificate pinning, and prompt sanitization.

The x402 protocol remains in its early stages. As with any web-native payment system, security emerges from adversarial testing. The twenty attack vectors discovered by researchers suggest we need more public scrutiny before agents routinely pay their way across the internet.