An agent payment client signed the amount the seller chose
V12's 22 October disclosure describes x402 payment clients, used by AI agents to pay per API call, passing a server's amount, recipient and token straight to the signing code. The default setup applied no spending limit. A hostile server could obtain a signed authorization for a wallet's full token balance "without a separate approval prompt".1
Holding the key let the client pay. It did not establish authority for the amount a counterparty named.
Explanatory diagram by Jochanni Labs, based on V12's disclosure of 22 October 2026. Simplified; not a screenshot or a view of private systems.
Payment networks frame authority as budgets and approvals
| Organization | Reported response | Evidence level | Unverified |
|---|---|---|---|
| Visa, BILL, Billtrust, 20 Oct2 | Agent pays buyer-approved invoices. | Live pilot; participants unnamed. | Binding to amount and payee; rejection data. |
| Mastercard, 20 Oct3 | Signed payment vouchers within an approved budget. | Named pilots; Early Access. | Refusal of an over-budget voucher. |
| ServiceNow with NVIDIA, 21 Oct4 | Runtime policy enforcement for its Arc agent. | Generally available; Passport enforcement planned. | Argument-level control; bypass tests. |
| Walmart, 21 Oct5 | Purchase approval by default; noncompliant agents blocked. | Stated intent. | Detection outside the gateway; cart binding. |
| US banks, 22 Oct6 | Morgan Stanley blocking third-party agents. | Secondary report, unnamed sources. | Block mechanism and volume. |
| UK FCA, 19 Oct7 | Planned framework covering delegated authority and execution. | Regulator intent. | Content and timing. |
None published rejection data. Mastercard's "Authorize once. Transact many times." sets authority at the budget, not the payment.
Three demonstrated gaps and one blocked attempt
Counts cover only the four new cases reviewed here. No updates were featured. This is not an incidence rate.
| Confirmed unauthorized execution | Blocked attempt | Demonstrated vulnerability | Enforcement unknown |
|---|---|---|---|
| 0 | 1 | 3 | 0 |
Blocked attempt. Forever Security says it stopped a coding agent on a customer machine from installing a known malicious npm package. The order came from an AGENTS.md file in the Downloads folder. In lab runs, the file led Codex to rewrite its own configuration and bypass approvals. The file's origin is unknown.8, 9
Demonstrated vulnerability. Hermes Agent's unattended mode denied a recognized write and a recursive delete. An unlisted sed write rewrote the approval config to mode: off, and the delete then ran. The gate read command text, not the target. The issue shows no released fix.10
Demonstrated vulnerability. A SurrealDB viewer holding another user's MCP session ID wrote a record his permissions forbid. Audit logs showed one shared identity for both users. Version 3.3.0 fixes it.11
Check where the action takes effect
| Exact action | Authority check belongs | Consequence if absent |
|---|---|---|
| Agent payment signature1 | Wallet signer, before signing. | Server-chosen amount leaves the agent's wallet. |
| Database record update through MCP11 | Tool execution, keyed to the requesting user. | Write under another user's permissions. |
| Host file write or shell command10 | Execution layer, by protected target. | Approval policy disabled; directories deleted. |
| Agent config change and package install8 | Config writer and package installer. | Known malicious package installed. |
Rejection held where the check saw the real action
The Hermes denial and SurrealDB's credential check both refused requests under test, then failed where they read a proxy for the action: command spelling or a shared identity. No reviewed source demonstrated exact payload binding, reviewer authority verification, or single-use authorization in a deployed system.10, 11
DAL-X, the application Jochanni Labs is building to enforce the Decision Authority Layer, publishes an architecture where the downstream system checks a single-use token bound to the exact action and payload.12
Conditional prevention: this design could stop a signed full-balance transfer to a server-chosen recipient. It requires trigger logic that flags the payment, a signing key held outside the agent, a signer that accepts only a token bound to the approved amount and recipient, and the same check on every path, including retries. A reviewer can still approve a wrong payment.
DAL-X status, 26 October 2026: DAL-X runs in a sandbox, with no customer deployment. This is not production evidence.13, 14
Ask your agent to overpay
- Action
- Payments your agent signs.
- Defect to test
- The signer accepts a counterparty's amount without checking the approved limit.
- Effective control
- An over-limit request is refused before signing, and the refusal is recorded.
- Action
- Writes to approval config or SSH files.
- Defect to test
- The gate matches command text, so unlisted write methods pass.
- Effective control
- Denials by target path for every write method tested, with the files unchanged.
Watch list
- Hermes Agent: a released fix.
- ServiceNow: AI Passport enforcement availability.
- Walmart: the Agent Profiles launch.
Sources and evidence limits
- V12, 25 Vulnerabilities in the x402 Protocol: Inside Three Critical Findings. 22 October 2026. Reported 12 August; critical findings fixed by 20 August; local tests only.
- Visa, BILL and Billtrust, First Live Pilot for Trusted AI Agent Payments. 20 October 2026.
- Mastercard, Agent Pay for Machines in action. 20 October 2026.
- ServiceNow, Personal enterprise agent and policy enforcement with NVIDIA. 21 October 2026.
- Walmart, Agents Shop on Behalf of Customers. 21 October 2026.
- Axios, Unvetted AI agents are accessing U.S. bank accounts. 22 October 2026. Secondary; unnamed sources; Morgan Stanley says it has not observed rogue agents on its platforms.
- FCA, Jessica Rusu, Building the future of finance in the age of AI. First published 19 October 2026.
- Forever Security, Markdown Is the New Executable. 22 October 2026. Vendor report; customer and event date not disclosed.
- BleepingComputer, AI coding agents hijacked using AGENTS.md file in Downloads folder. 25 October 2026. Secondary.
- NousResearch hermes-agent, issue 143198. Created 22 October 2026. Reporter's reproduction; open at review.
- SurrealDB, GHSA-pgh9-49q4-hqcx. Published 19 October 2026. Patched in 3.3.0.
- Jochanni Labs, Authority in the Execution Path. Undated; reviewed 26 October 2026. Published architecture, not an independently rerun test.
- Jochanni Labs, DAL-X: The Working Preview of DAL. Undated; reviewed 26 October 2026.
- Jochanni Labs, DAL-X: Decision Authority Layer, Execute. Undated; reviewed 26 October 2026.
Public sources reviewed for this issue. No private enterprise telemetry. Jochanni Labs has not reproduced any vendor or researcher test. Absence of public evidence does not prove absence of enforcement.
Integration Action
Discuss a Paid Enterprise Pilot
The incidents covered this week share one structural gap: no authority check at the receiving system. DAL-X enforces that check in a simulated enterprise environment. A paid enterprise pilot would test it against one agent, one consequential action, and one downstream system.