AI agents are now executing real payments through protocols like x402, but the infrastructure leaves businesses and users exposed when those agents select the wrong merchant, quantity, or recipient. The CoinDesk newsletter Crypto Long & Short highlighted this gap on October 28, 2026, noting that the largest card networks sit in the top governance tier of x402 with no standard dispute process attached.
x402 and the New Payment Rails
The x402 protocol, originally published by Coinbase in May 2025 and moved under the Linux Foundation’s x402 Foundation in July 2026, allows servers to request stablecoin payments directly in HTTP responses. An agent signs an authorization, a facilitator pushes the transaction onchain, and settlement occurs without an intermediary issuer. Visa, Mastercard, and American Express rank among the 17 premier members of the foundation, giving them a seat at the table for a system that processes millions of transactions but lacks chargeback mechanisms once funds move onchain.
Research from the Swiss Federal Institute of Technology in Lausanne and Zhejiang University examined 15 live x402 facilitators and found every one violated at least one of eight defined safety rules. On Base alone, roughly 2 percent of settlement attempts reverted in late 2025, equating to about 1.9 million payments. These reversions highlight early infrastructure fragility, yet the larger issue arises when settlement succeeds and the delivered good or service proves incorrect or useless.
Scale of Activity and Real-World Incidents
BeInCrypto’s State of AI Agent Payments 2026 report tracked 6.4 million x402 payments over 35 days across Base and Solana. More than 90 percent of those payments were worth less than one cent, with total value moving just $119,947. Most activity involved API access, compute resources, and data requests rather than large autonomous purchases. Institutional financial workflows scored only 12 out of 100 on the report’s readiness scale, compared with 60.7 for micropayments.
Despite the small average size, documented failures show how quickly exposure can grow. One February 2026 incident involved an AI agent created by an OpenAI developer that transferred tokens worth approximately $250,000 after misreading a request for 4 SOL as a much larger amount. The recipient sold the tokens within 15 minutes. Other cases include prompt-injection attacks that tricked agents into draining wallets, such as a May 2026 Morse-code message that led to roughly $175,000 in transfers through a Grok-linked service, and a separate dashboard compromise that sent $106,200 in ETH to an attacker.
Additional examples compiled by researchers include an agent that retried an ambiguous payment confirmation 40 times, spending $3,200 instead of the intended $80, and agents that purchased higher-tier plans or extra datasets because their task descriptions were interpreted broadly. In each case the transaction cleared every configured limit yet produced an outcome the deployer did not intend.
Liability and Recovery Challenges
Traditional card networks rely on issuers and chargeback rules that assume a human cardholder will notice and contest an error. x402 payments settle directly onchain in stablecoins, removing that safety net. Albert Castellana of GenLayer Labs, writing in the CoinDesk newsletter, emphasized that software does not read monthly statements the way people do, so the assumption that someone will flag a problem breaks down.
Analyses from multiple outlets, including Stablecoin Insider and Fintechly, point out that the attack surface often lies upstream of the wallet itself. Poisoned tool descriptions, impersonating software packages, or payee definitions changed after initial approval can supply an agent with a malicious destination without ever touching private keys. Recovery then depends on whether the funds can still be reached through a venue or issuer, which is rarely straightforward once onchain settlement occurs.
Legal frameworks such as the Uniform Electronic Transactions Act offer some recourse for electronic agent errors when providers fail to supply reasonable means to prevent or correct mistakes, yet these protections remain untested at scale for autonomous crypto payments. Deployers, developers, platforms, and merchants each face potential liability depending on authorization scope, audit trails, and who controlled the final decision.
Broader Context and Next Steps
The rise of agentic payments intersects with wider stablecoin usage trends. Integrations by Visa, Mastercard, and Stripe have supported rising payment volumes even as overall supply growth has moderated, a dynamic explored in this publication’s coverage of stablecoin supply near $305 billion. The same card networks now help govern x402, creating overlap between traditional rails and onchain agent flows.
Practical defenses discussed across sources include strict per-counterparty allowlists, hard spending ceilings enforced outside the agent’s control, real-time alerts on anomalous activity, and sandbox testing before live deployment. Some architectures separate an IOU balance or task-specific budget from the main wallet so that even repeated errors cannot exceed a preset cap. Others emphasize verified registries for addresses and merchants rather than allowing model output to determine destinations.
As adoption grows, the absence of standardized dispute resolution will likely prompt calls for new governance rules, clearer liability allocation, or hybrid systems that retain limited off-chain reversibility. For now, the technical rails function, but the economic and legal consequences of an agent paying for the wrong thing remain with the entity that granted the agent its authority.
Businesses experimenting with these tools are advised to treat spending limits as necessary but insufficient. The decisive controls are those that constrain not only how much an agent can spend but also to whom and on what terms, backed by continuous monitoring and rapid revocation capabilities.
