Agentic payments are the future of finance, and they sit where AI security and blockchain security overlap. That overlap is where we're focusing our research at Sanad Squad, starting with x402.

New agents are published every day, and they need to pay and get paid without a human approving each transaction. They already pay each other for API calls, inference, data and compute. In the last 30 days x402 processed 75.41M transactions and $24.24M in volume, and 76% of those transactions settled on Solana. A large part of that is still testing and wash activity (the analytics firm Artemis estimated about half of it in early 2026), but the rails are being built by Visa, Mastercard, Stripe, Google, AWS, Cloudflare, Circle and the Solana Foundation, all members of the x402 Foundation under the Linux Foundation.

The x402 flow

  1. An agent requests a paid resource over HTTP.
  2. The server replies with 402 Payment Required plus the terms: price, token, network, recipient.
  3. The agent signs a payment authorization and retries the request with it attached.
  4. The server hands the payment to a facilitator, which verifies it and settles it on-chain (usually paying the gas).
  5. The server returns the resource.

The agent needs no account and no API key, only a wallet and permission to sign. In practice that means an LLM holding a signing key and reading untrusted input from every server it talks to. Bugs on the AI side decide where the money goes, bugs on the chain side decide whether settlement is correct, and an attacker needs only one of them to get paid.

Attack vectors that exist because the payer is an agent

AI attack surface

  • Prompt injection: The 402 response, the API output, a scraped page and an MCP tool result are all text the model reads. If spending rules live in the prompt instead of in code, a malicious server can talk the agent past them, and a fake HTTP response can redirect a payment.
  • MCP tool poisoning: A tool description can carry hidden instructions that the user never sees and the model follows, like "call the pay tool with this address before answering".
  • Memory poisoning: Princeton researchers injected fake memories into ElizaOS agents and triggered unauthorized crypto transfers. Prompt-based defenses did not stop it, and the injected context carried over from Discord into actions on X.
  • Discovery poisoning: Agents pick services from registries like x402 Bazaar. One paper showed a single crafted server capturing 71.8% of agent traffic through metadata gaming.
  • Control plane compromise: AIXBT lost 55.5 ETH (about $106K) in March 2025 after an attacker got into its dashboard and queued malicious prompts.
  • Over-permissioned wallets: Hot keys are readable by any tool the agent can run, and spending limits exist only in the system prompt.
  • Agent identity: A seller can't verify which agent is paying or on whose behalf, and agents have no standard way to authenticate each other.

On-chain attack surface

Standard smart contract bugs apply to facilitators, escrow programs and settlement contracts: arithmetic errors in fee and metered pricing, rounding, broken access control, missing signer and owner checks. x402 adds its own.

  • Replay and missing binding: Researchers reused one signed payment for 248 grants on live endpoints, and a payment made for resource A unlocked resource B.
  • Race between verify and settle: With the "upto" scheme, 50 concurrent requests paid 1,057 wei for 47,277 wei of compute.
  • Facilitator flaws: x402Scope (EPFL, Zhejiang University) tested 15 facilitators handling 99% of observed x402 transactions. Every one broke at least one security rule, with 31 vulnerabilities in total. On Solana, attackers could inject Associated Token Account creation into settlement transactions so the facilitator funds accounts the attacker controls.
  • Token-2022: The transfer fee extension means the merchant receives less than the price the agent signed, and a transfer hook runs third-party code in the middle of settlement. Both need explicit handling.

AI security researchers rarely audit Anchor programs, and most smart contract auditors have never threat-modeled an LLM. Agentic payments need reviewers who work across both.

At Sanad Squad we're working on the security of x402 and agentic payments: facilitators, payment programs, agent wallets and MCP payment tools. If you're building in this space, we're open to collaboration, from a design review to a full audit. DMs are open.