- Ishween Kaur of SoFi broke the x402 agent payment protocol 20 ways in a test setup, including price changes, free cache access and lookalike sellers.
- She argued that an agent can lose money without being broken, so buyers and sellers both need checks around each payment.
Ishween Kaur of SoFi said she broke the x402 agent payment protocol in 20 ways, in a safe test setup. She spoke on the AI Engineer show. Her warning: an agent can lose money without being faulty.
What was said
The web has had a 402 status code, meaning payment required, for decades. It never said how a machine could pay. Kaur said x402 fills that gap. She added that Cloudflare is exploring pay per crawl, where publishers name a price for their data. In her words, "software is becoming a buyer now."
In her first attack, a seller lists five cents in a directory. The price in the 402 payment header can change at the last moment. With no guard, her agent paid 50 cents. A check comparing the two prices stopped it.
Other attacks gave data away free. If a report sits on two pages and only one is paywalled, a buyer can use the open one. A seller's cache on a public address can serve paid data to the next buyer. Her test: call every paid endpoint and expect a 402.
Lookalike sellers came fifth. The Bazaar directory checks that a service works, she said, but not who runs it or owns its wallet. Her agent picked a cheaper copy. "But agent doesn't have to be even broken to lose money."
Why it matters
Our reading: a price on a web page turns payment mistakes into ordinary web mistakes. Headers, caches and directory entries now guard money. So ask who owns each one.
For a seller, ask the team running the cache and the API two things. Has anyone called every paid endpoint and seen a 402? Does the cache check payment before serving saved data? For a buyer, ask the agent team Kaur's three questions. Is the seller allowed? Is the amount within budget? Is this the data we approved? Also ask what happens if a payment verifies but then fails at settlement, as she described.
The other side
Kaur ran her tests on a test network with Llama 3.2. She gave no loss figures from real deployments. She did not say Cloudflare's pay per crawl has these flaws.
Her fixes cost something. Waiting for settlement is safer but slower. For data worth a tenth of a cent, she said sending early may be fine. An approved-sellers list clashes with agents that must find new sellers, so she suggested a probation list. Even honest sellers rotate domains and wallets, so no list stays true alone.
Written by the WebPulse Newsroom with AI assistance, and checked by our editorial review: every quotation was verified against the recording's transcript. How we use AI.
The conversation this talking point comes from
- AI Engineer: Your Agent Just Paid for Nothing: 6 Attacks on x402 Payments - Ishween Kaur, SoFi (2026-10-30)
