x402 turns an HTTP 402 Payment Required into something an autonomous agent can actually act on: the server quotes a price, your agent pays in stablecoin, the request goes through. No human in the loop. That is the whole point — and also the whole problem.
The moment a program can move money without you watching, "discovery" and "payment" collapse into a single step. Your agent finds an endpoint and pays it in the same breath. If anything about that endpoint is wrong — the address, the price, the destination — the money is already gone by the time you would have noticed.
There is now a small but real body of work on how this gets exploited. Five Attacks on x402 and A402 (both on arXiv), Halborn's writeup, and AgentLISA's position paper all converge on the same handful of attack vectors. I read through them while building Frisk, an open-source pre-transaction screening library, and I want to do something specific in this post: walk the documented attacks, and for each one, be honest about whether you can catch it locally, before the payment, in your own code — or whether it fundamentally requires data you don't have on your machine.
That line — local-and-deterministic vs. needs-reputation-data — turns out to be the most useful way to think about agent payment safety. So let's draw it.
