SAN FRANCISCO — When an autonomous AI agent requests a data product and the merchant delivers it within seconds, the payment has already cleared an off-chain verification checkpoint. What can follow is quiet ruin: the blockchain transaction expires before it settles, the payment fails on-chain, and the agent keeps the service. The merchant absorbs the cost.
That attack path, which researchers call “free shopping,” is not a theoretical edge case. It is one of six attack methods that security researchers directly validated against live production systems, and it runs across every major AI payment platform in the emerging autonomous commerce stack, including Coinbase.
Researchers presenting findings at the 35th USENIX Security Symposium disclosed this week that Coinbase and 14 other x402 payment facilitators had accumulated 49 rule violations mapping to 31 distinct vulnerabilities. Every single platform tested violated at least one security rule. Together, the systems covered in the study handled 99 percent of observed x402 transactions and 98 percent of all payment volume during the October to December 2025 measurement window, CryptoSlate reported.
The x402 standard revives the long-dormant HTTP 402 “Payment Required” status code, turning it into infrastructure for machine-driven commerce. Under x402, AI agents can pay APIs, data feeds, and digital tools in fractions of a second without human authorization for each transaction. Facilitators like Coinbase sit between the buyer and the merchant, checking signed payment authorizations before submitting transactions to a blockchain. Their position concentrates both the value of the system and its risk.
Coinbase dominated the researchers’ dataset. The company processed 77.17 million transactions during the study period, representing nearly $27 million in payment volume, far outpacing any other facilitator. More than 93 percent of the roughly 53,500 unique merchant servers in the study were associated with a single facilitator, a concentration that means a flaw, an outage, or a software assumption gone wrong at that provider does not stay local. It propagates.
The most severe attack path the researchers identified exploits ERC-6492, an Ethereum signature standard built to support signatures from smart-contract wallets that haven’t yet been deployed on-chain. Researchers found that malicious metadata could redirect a facilitator into funding and submitting an arbitrary token-approval transaction rather than the expected payment. The team stopped short of actually moving funds. But they classified the path as direct asset theft, because an attacker with that approval authority could drain the facilitator’s holdings.
Three of the six validated attacks involved gas abuse, the ability to force facilitators to absorb attacker-driven blockchain transaction costs. Because many platforms sponsor network fees on behalf of merchants, an attacker who triggers expensive smart-contract initialization can shift those costs, potentially without limit, onto the provider. Across 119 million x402 transactions on the Base and Solana networks, facilitators spent roughly $202,000 in total network fees, including about $5,800 on Base transactions that reverted or failed. Whether any of those reverted transactions were the product of deliberate abuse or routine settlement errors, the paper does not say.
The Coinbase-specific findings extended beyond its facilitator infrastructure to the software kits it distributes to merchants. All seven of the company’s official Flask server reference kits through version 0.2.1 lacked any mechanism for reversing actions taken after a successful off-chain payment verification but before on-chain settlement succeeded. A merchant running those kits releases a product or opens an API the moment verification passes, without any built-in path to claw it back if the blockchain payment subsequently fails. That design is especially exposed in markets where AI agents move faster than human review, and where the product being sold is often irreversible.
The research lands at an inflection point for U.S. crypto regulation. The CLARITY Act faces a September 15 cloture vote after months of delay, its passage dependent on Democrats who have conditioned their support on the president divesting from crypto businesses. Crypto and prediction market executives are scheduled to make their case at the White House on August 19. And Kalshi, a federally licensed prediction market, is contesting a $36 billion New York lawsuit that could determine whether AI-mediated event-contract payments count as regulated derivatives or illegal gambling.
The stakes for x402 are set by McKinsey’s projection that AI agents could mediate $3 trillion to $5 trillion in global consumer commerce by 2030. The payment rail being built to carry that traffic, according to the USENIX research, is already broken in ways that every major facilitator has failed to fix before launch.
Remediation has begun. As of February 6, Coinbase, PayAI, and Mogami had collectively confirmed six vulnerabilities. Some had been patched. Work on others continued. The researchers did not map individual vulnerabilities to specific providers, making it impossible to determine from public filings which platform remained exposed to which attack as of the paper’s presentation. Whether the confirmations have translated into production fixes that merchant-side applications are actually running is not established by the available record.
Recommendations from the paper are direct: treat all client-provided transaction fields as untrusted; recheck payment conditions immediately before final settlement; impose hard limits on facilitator-sponsored gas costs. For merchants, the guidance is simpler and harder to implement at AI speeds: hold irreversible services until the blockchain transaction confirms, or build in a reliable mechanism to reverse delivery when payment fails.
That last instruction runs against the grain of how AI commerce is being designed. The point of autonomous payment is that the agent acts faster than any human confirmation loop, and that the infrastructure handles the trust. The USENIX findings suggest the infrastructure has not yet earned it.
Related Posts
