When you configure an AI agent to pay for services, you expect it to stick to the budget you set. But a new investigation by developer Cleiton Augusto Correa Bezerra reveals that this expectation might be dangerously misplaced. In a recent post on DEV.to, Bezerra demonstrated that some agent payment SDKs verify spending limits against a quote the agent sees, but then sign a completely different payment authorization sent by the server moments later. This disconnect means an agent configured with a $0.50 USDC limit could inadvertently sign a transaction for $0.90 USDC, or pay a different address entirely, without triggering any safety checks.

The Two-Step Payment Trap

The issue stems from how the x402 protocol, which turns HTTP 402 status codes into payment requests, is often implemented in two distinct steps. First, the agent makes a request and receives a 402 response containing a quote, such as "0.10 USDC to 0x1111." The agent’s logic checks this quote against its configured limits and decides it is acceptable. Second, the agent executes a payment action that sends a new request to the server. If this second request triggers a new 402 response with different terms, and the SDK signs that new response without re-validating against the original approved quote, the limit check is bypassed. Bezerra describes this as rediscovering an old problem in hardware wallets and European card payments: ensuring that what the user approves is exactly what gets signed.

Conformance Test Results

To prove this, Bezerra built a local test harness, x402-conformance, that simulates a dishonest seller. The harness quotes one price and payee on the initial request, then changes the terms on subsequent requests. He tested three major SDKs with a configured limit of 0.50 USDC across seven scenarios, including price hikes and payee swaps. The results were mixed: vAPI Network core 0.12.0 and BlockRun ClawRouter 0.12.312 passed all 14 runs, correctly refusing to sign unauthorized changes. However, the main branch of Coinbase AgentKit failed 6 out of 14 runs. In failing cases, the agent signed 0.90 USDC when it had only approved 0.10 USDC, or signed for Base mainnet when it had approved Base Sepolia. Notably, the released version 0.10.4 does not enforce spend caps at all, leaving that responsibility to the developer.

Best Practices for Safe Payments

The passing SDKs demonstrate two robust patterns for avoiding this trap. vAPI Network parses the 402 response immediately before signing, applies the price limit and payee checks to that specific quote, and refuses to retry if the server returns a changed quote. BlockRun ClawRouter uses an onBeforePaymentCreation hook to enforce policy on the exact requirement about to be signed, utilizing allowlists for payee, network, and asset. Both approaches ensure that the spending policy is bound to the payment authorization itself, not just the initial quote. Bezerra emphasizes that the x402 specification currently lacks a client conformance test for this behavior, a gap he plans to address with the x402 Foundation.

Key Takeaways

  • Verify the Signature, Not Just the Quote: Ensure your payment SDK checks spending limits against the exact data being signed, not just the initial server response.
  • Use Conformance Tests: Run local tests like Bezerra’s x402-conformance harness to simulate dishonest servers and validate your agent’s behavior.
  • Bind Approval to Settlement: Implement logic that refuses to sign if the payee, amount, asset, or network differs from what was originally approved.
  • Check SDK Versions: Older or unreleased versions of agent payment libraries may lack built-in limit enforcement or have known bugs in their two-step payment flows.

The Bottom Line

Configuring a spending limit is useless if the SDK ignores the final terms it signs. Developers must prioritize SDKs that bind approval to settlement, or build their own validation layers that check the exact payload before signature. Until the x402 specification includes mandatory client conformance tests for this behavior, assume your agent is flying blind on price integrity.