What we’ve learned trying to trick paying agents.
Our findings, the taxonomy every attack is classified by, the prior work we build on, and how the lab keeps its results honest. The raw runs are public in the lab.
Finding 0001: Wallet-side policy is easy to misconfigure into uselessness
A wallet policy engine can constrain an x402 payment on its own, but three silent integration traps push teams toward deleting the very clauses that cap spending.
20 September 2026Read TaxonomyAttack taxonomy for paying agents
Every red-team scenario is classified on three independent axes: how the attacker reaches the agent, how the payload evades filters, and what effect crosses the payment boundary.
Read SurveyRelated work: where agent-payment security stands
A 2026 scan of benchmarks, protocol attacks, standards and products, and the gap between them that our lab targets.
Read MethodHow the red-team lab works
A real agent, real x402 merchants, a real wallet and real testnet settlement, with attackers allowed to change content and intent but never the controls.
Read