# x402-protocol

Published articles for x402-protocol.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## An Adversarial Audit Found 39 Fulfillment and Checkout Vulnerabilities in an AI-Agent Storefront

DevFeed: [An Adversarial Audit Found 39 Fulfillment and Checkout Vulnerabilities in an AI-Agent Storefront](<https://devfeed.tech/articles/i-told-an-ai-agent-to-rob-my-store-it-found-39-ways-to-do-it-59963.md>)

Original publisher: [Read original article](<https://hackernoon.com/i-told-an-ai-agent-to-rob-my-store-it-found-39-ways-to-do-it?source=rss>)

Author: keeper

Published: 2026-09-25T09:00:11Z

Content type: opinion

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [audit](<https://devfeed.tech/topics/audit.md>), [Security, Privacy and Abuse Prevention](<https://devfeed.tech/topics/security-privacy-and-abuse-prevention.md>), [Code](<https://devfeed.tech/topics/code.md>), [Artificial Intelligence](<https://devfeed.tech/topics/ai.md>), [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [HTTP](<https://devfeed.tech/topics/http.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agentic-commerce](<https://devfeed.tech/tags/agentic-commerce.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agent-payments](<https://devfeed.tech/tags/ai-agent-payments.md>), [audit](<https://devfeed.tech/tags/audit.md>), [code](<https://devfeed.tech/tags/code.md>), [fault-injection-testing](<https://devfeed.tech/tags/fault-injection-testing.md>), [hackernoon-top-story](<https://devfeed.tech/tags/hackernoon-top-story.md>), [http](<https://devfeed.tech/tags/http.md>), [idempotency](<https://devfeed.tech/tags/idempotency.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-payments](<https://devfeed.tech/tags/mcp-payments.md>), [transaction](<https://devfeed.tech/tags/transaction.md>), [usdc-payments-for-agents](<https://devfeed.tech/tags/usdc-payments-for-agents.md>), [validation](<https://devfeed.tech/tags/validation.md>), [x402-protocol](<https://devfeed.tech/tags/x402-protocol.md>)

### AI overview

An adversarial audit of a live storefront for AI-agent customers found 39 ways to accept payment without delivering the intended product. The findings included null-byte input bypasses that produced empty artifacts and cache keys that omitted a claim, causing corrected purchases to return an earlier result.

### Source excerpt

An adversarial audit of a live x402 agent storefront found 39 ways to take payment without delivering. None were payment bugs. Here are the four worst.

## An Autonomous Agent Cold-Emailed Me a Free Audit at 12:45 AM

DevFeed: [An Autonomous Agent Cold-Emailed Me a Free Audit at 12:45 AM](<https://devfeed.tech/articles/an-autonomous-agent-cold-emailed-me-a-free-audit-at-12-45-am-59661.md>)

Original publisher: [Read original article](<https://hackernoon.com/an-autonomous-agent-cold-emailed-me-a-free-audit-at-1245-am?source=rss>)

Author: keeper

Published: 2026-09-24T20:25:19Z

Content type: article

Language: en

Sources: [HackerNoon](<https://devfeed.tech/sources/hackernoon.md>)

Topics: [AI Agent](<https://devfeed.tech/topics/ai-agent.md>), [audit](<https://devfeed.tech/topics/audit.md>), [trust](<https://devfeed.tech/topics/trust.md>), [ed25519](<https://devfeed.tech/topics/ed25519.md>), [Protocol (disambiguation)](<https://devfeed.tech/topics/protocol.md>), [Solana](<https://devfeed.tech/topics/solana.md>)

Tags: [agent](<https://devfeed.tech/tags/agent.md>), [agent-to-agent-commerce](<https://devfeed.tech/tags/agent-to-agent-commerce.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agent](<https://devfeed.tech/tags/ai-agent.md>), [ai-agent-economy](<https://devfeed.tech/tags/ai-agent-economy.md>), [ai-agent-payments](<https://devfeed.tech/tags/ai-agent-payments.md>), [audit](<https://devfeed.tech/tags/audit.md>), [autonomous](<https://devfeed.tech/tags/autonomous.md>), [claude](<https://devfeed.tech/tags/claude.md>), [conformance-testing](<https://devfeed.tech/tags/conformance-testing.md>), [ed25519](<https://devfeed.tech/tags/ed25519.md>), [fault-detection](<https://devfeed.tech/tags/fault-detection.md>), [payment-testing](<https://devfeed.tech/tags/payment-testing.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [protocol-interoperability](<https://devfeed.tech/tags/protocol-interoperability.md>), [solana](<https://devfeed.tech/tags/solana.md>), [trust](<https://devfeed.tech/tags/trust.md>), [x402-protocol](<https://devfeed.tech/tags/x402-protocol.md>)

### AI overview

An autonomous agent audits a store's x402 payment endpoint, paying real money to run conformance checks and publishing a signed result. The store operator verifies the cryptographic certificate and settlement, then identifies and reports a mismatch between the agent's outreach and its published offerings.

### Source excerpt

An autonomous AI agent audited my x402 endpoint for free. We cross-checked each other's instruments, and each of us found a defect in our own.

## What Is the x402 Protocol? HTTP 402 Payments for AI Agents

DevFeed: [What Is the x402 Protocol? HTTP 402 Payments for AI Agents](<https://devfeed.tech/articles/what-is-the-x402-protocol-http-402-payments-for-ai-agents-10450.md>)

Original publisher: [Read original article](<https://dodopayments.com/blogs/x402-protocol/>)

Author: Ayush Agarwal

Published: 2026-09-08T00:00:00Z

Content type: article

Language: en

Sources: [Dodo Payments Blog](<https://devfeed.tech/sources/dodo-payments-blog.md>)

Topics: [HTTP](<https://devfeed.tech/topics/http.md>), [API Monetization](<https://devfeed.tech/topics/api-monetization.md>), [A2A protocol](<https://devfeed.tech/topics/a2a-protocol.md>)

Tags: [2](<https://devfeed.tech/tags/2.md>), [a2a](<https://devfeed.tech/tags/a2a.md>), [about](<https://devfeed.tech/tags/about.md>), [agents](<https://devfeed.tech/tags/agents.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [card](<https://devfeed.tech/tags/card.md>), [guide](<https://devfeed.tech/tags/guide.md>), [handshake](<https://devfeed.tech/tags/handshake.md>), [headers](<https://devfeed.tech/tags/headers.md>), [http](<https://devfeed.tech/tags/http.md>), [payment](<https://devfeed.tech/tags/payment.md>), [payments](<https://devfeed.tech/tags/payments.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [rails](<https://devfeed.tech/tags/rails.md>), [required](<https://devfeed.tech/tags/required.md>), [what-is](<https://devfeed.tech/tags/what-is.md>), [works](<https://devfeed.tech/tags/works.md>), [x402](<https://devfeed.tech/tags/x402.md>), [x402-protocol](<https://devfeed.tech/tags/x402-protocol.md>)

### AI overview

x402 lets a client pay for one resource request without an account or API key: the server returns HTTP 402 with payment requirements, the client signs a payment and retries with `PAYMENT-SIGNATURE`, and the server verifies and settles it before returning the resource. An optional facilitator handles `/verify` and `/settle`, sparing the seller chain infrastructure; servers can also handle those steps themselves. The protocol supports multiple payment options, but a transaction requires the client and facilitator to support the same scheme and network. Its `exact` scheme covers fixed amounts; other schemes remain under development. x402 suits machine-to-machine micropayments, but requires a funded wallet and token settlement and does not provide subscriptions, chargebacks, tax handling, invoicing, or fiat payouts. The article recommends pairing it with a separate billing rail when serving human subscribers.

### Source excerpt

A technical guide to the x402 protocol: how the HTTP 402 payment handshake works, the PAYMENT-REQUIRED and PAYMENT-SIGNATURE headers, facilitators, payment schemes, and where x402 fits next to card rails.