--- title: Your Agent Just Paid for Nothing: 6 Attacks on x402... description: x402 lets AI agents pay for data and APIs with tiny on-chain payments over HTTP. Ishween Kaur explains how the protocol works, then walks through six of the 20... canonical: https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi | daily.dev og:description: x402 lets AI agents pay for data and APIs with tiny on-chain payments over HTTP. Ishween Kaur explains how the protocol works, then walks through six of the 20... og:url: https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1 og:image: https://api.daily.dev/og/posts/m4foKAWK1.png og:image:alt: Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi **[AI Engineer](https://daily.dev/sources/aidotengineer)** · 16 min read · 0 upvotes · 0 comments ## Summary x402 lets AI agents pay for data and APIs with tiny on-chain payments over HTTP. Ishween Kaur explains how the protocol works, then walks through six of the 20 ways she broke it in a safe test environment: price changes in the payment header, paying twice, getting data for free, one payment unlocking many pages, lookalike sellers, and prompt injection that talks an agent into paying again. For each one, she shows the guard that stopped it and how to roll out agent payments safely, trace by trace. Chapters: 0:00 Intro 0:31 Paying for things you use once 1:33 HTTP 402 and the x402 protocol 2:09 How x402 works 3:24 What happens when agents can pay 4:05 Attack 1: Price manipulation 5:24 Attack 2: Paying twice 7:03 Attack 3: Free shopping 9:13 Attack 4: One payment, many pages 10:04 Attack 5: Lookalike sellers 11:43 Attack 6: Prompt injection 14:10 Rolling this out safely 16:23 Should we let agents pay? Ishween Kaur https://www.sofi.com Join us in SF for the second annual AIE CODE summit: https://aie.codes our last flagship summit of 2026. Applications live now! ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#ai](https://daily.dev/tags/ai), [#ai-engineering](https://daily.dev/tags/ai-engineering) [View this post on daily.dev](https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi","url":"https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1"},"datePublished":"2026-10-30T09:10:16.929Z","dateModified":"2026-10-30T10:57:28.201Z","description":"x402 lets AI agents pay for data and APIs with tiny on-chain payments over HTTP. Ishween Kaur explains how the protocol works, then walks through six of the 20...","image":"https://i.ytimg.com/vi/YU1uD_YkpjU/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/YU1uD_YkpjU/sddefault.jpg","isAccessibleForFree":true,"articleSection":"AI Engineer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"AI Engineer","logo":"https://media.daily.dev/image/upload/s--u5PucxNT--/f_auto/v1724338940/logos/aidotengineer","url":"https://daily.dev/sources/aidotengineer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/your-agent-just-paid-for-nothing-6-attacks-on-x402-payments---ishween-kaur-sofi-m4fokawk1","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai,ai-engineering","timeRequired":"PT16M","video":{"@type":"VideoObject","name":"Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi","description":"x402 lets AI agents pay for data and APIs with tiny on-chain payments over HTTP. Ishween Kaur explains how the protocol works, then walks through six of the 20...","thumbnailUrl":"https://i.ytimg.com/vi/YU1uD_YkpjU/sddefault.jpg","uploadDate":"2026-10-30T09:10:16.929Z","duration":"PT16M","url":"https://api.daily.dev/r/m4foKAWK1","embedUrl":"https://www.youtube.com/embed/YU1uD_YkpjU"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"AI Engineer","item":"https://daily.dev/sources/aidotengineer"},{"@type":"ListItem","position":3,"name":"Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi"}]} ```