Security
What is Agentic payment security?
Agentic payment security covers the failure modes specific to payments initiated by autonomous software rather than people. The distinctive risks are substitution between resources, duplicate settlement under concurrency, spending beyond an authorised allowance, and pricing that the payer cannot verify before paying.
Academic work on x402 facilitators catalogues five flaw classes: cross-resource substitution, duplicate-settlement races, allowance overdraft, denial of settlement, and hidden-compute pricing (Ling et al., arXiv:2605.30998).
Four of the five admit engineering fixes. Substitution is closed by binding a payment to a specific resource with a signed commitment, so an authorisation for one endpoint cannot unlock another. Duplicate settlement is closed by making nonces single-use through an atomic claim that is linearised across every server instance — an in-memory set is not sufficient on serverless infrastructure, where each instance holds its own copy. Overdraft is closed by reserving against an allowance before committing. Denial of settlement is bounded by capacity limits with backpressure.
The fifth, hidden-compute pricing, is different in kind. A client cannot verify in advance that the compute it is being charged for was actually performed, so the honest description is mitigation — pricing models that make systematic overcharging detectable over time — rather than a fix. Treating it as solved is the mistake worth avoiding.
Related
Definitions are educational and general. Nothing here is financial, legal or tax advice, and regulatory descriptions summarise frameworks that change — check the current rules for your jurisdiction before relying on them.