x402, the HTTP 402 Payment Protocol for AI Agents, Shipped With No Spending Limit: V12 Found a Server Could Ask for the Whole Wallet
V12 found 25 flaws in the x402 payment SDKs AI agents use to buy API calls, three critical: no default spending cap, a Solana check that took a token approval as payment, and logins signed for the wrong site. The fixes shipped in August with no security advisory.