Safe rails for the agent economy. x402 payments that stay inside limits their owner signed. Open source · live on Base (beta) · built by @nicolas_tursi
Buenos Aires
Joined October 2026
- Tweets72
- Following50
- Followers10
- Likes48
Pinned Tweet
Your agent reads the web. The web can tell it to pay.
We hid a prompt injection in a docs page asking for 50 USDC. The policy gate runs outside the model, so the attacker got zero signatures.
npm install @deepfirstsearch/agent-pay
A neat x402 attack: a 402 declares 18 decimals for USDC (which has 6). A 1,000 USDC charge then reads as a fraction of a cent — slips under a dollar cap and gets signed.
Price in atomic units, never the server's decimals. Check yours: deepfirstsearch.com/x402-sca…
Agents can spend now. Who sets the limits?
Agent Safe lets the model propose a payment and the owner's signed policy decide: pinned payee, per-call cap, session budget. A prompt-injected agent can't overspend or pay the wrong wallet.
deepfirstsearch.com/develope…
An independent security review of our SDK found 9 issues. We fixed all 9 — each with a regression test.
Get reviewed, fix what's found, show the work. Thanks to Guido Dipietro for the review.
On-chain contracts audit next. deepfirstsearch.com
Deep First Search retweeted
AI agents are now paying for things on their own. Chainalysis counted 138 million x402 payments on Base alone. x402 is the standard Coinbase and Base built for machine to machine payments in USDC. Your agent reads a page, signs a payment, gets the data. Fully automatic.
But this opens two problems nobody has solved.
Security: your agent reads untrusted content all day, and it moves money. One poisoned page can trick it into paying the wrong wallet. This already happened, over 150 thousand dollars drained from one agent through a single prompt injection.
Privacy: every x402 payment is public. Payer, payee, amount, timing. Anyone watching the chain can read your balance, and your competitors can see your suppliers.
Deep First Search (@DeepFirstHQ) is building the fix. Safe rails for the agent economy, live on Base in beta. deepfirstsearch.com
Three layers, one SDK.
Agent Safe is an onchain vault built on one assumption, that your agent WILL be tricked. You sign a budget per merchant, and the agent's key can only spend inside it. It can never widen the budget, and you can pause or withdraw anytime.
The Policy gate treats every payment request as hostile. Payee, asset, network and price must match exactly what you approved before anything is signed. The model proposes, code decides.
Exposure control is the privacy layer. Each merchant sees a fresh payer with no history, and what your agent bought is shared with that merchant only. You can still prove any payment to an auditor, but nobody else can link it to you.
And this is shipped, not promised. Real payments settled on mainnet, a recorded Claude session that refused to pay a different wallet mid attack, four attack simulations with zero signatures sent, 260 plus tests. Works with Claude, Cursor, LangChain and Coinbase AgentKit. Non custodial, immutable contracts, open source.
No token exists yet. Their words: no token until there is revenue to burn. Product first, token last.
This matters now because Mastercard, Visa, Meta, Stripe and PayPal are all building agent commerce. Every one of those agents can move money, and none of them answer what happens when the agent gets tricked.
It is early. Unaudited beta, one builder, a big kudos to @nicolas_tursi. But the problem is only growing, and agent payments need guardrails. This is one of the first serious attempts at building them.
Follow @DeepFirstHQ
deepfirstsearch.com
We reviewed ~2 dozen published x402 buyer clients — the code an AI agent uses to pay.
About 4 in 10 signed a payment to whatever payee the 402 named. Redirect the 402, and the agent pays an attacker.
deepfirstsearch.com/findings
Cloudflare agents can now pay for x402 tools safely.
agent-pay-cloudflare drops into withX402Client: the agent only ever pays the payee you pinned, within a budget — even if prompt-injected.
deepfirstsearch.com/develope…
Paste an x402 endpoint URL, see the traps in its 402 — no install, nothing signed.
We built a hosted linter: it flags a fake-decimals amount, an unlimited Permit, a year-long window, the usual.
deepfirstsearch.com/scan
Your AI agent pays over x402. Does its client check WHO it's paying?
Unguarded, the base client signs to any payee, any price, any network.
Scan yours free with x402-scan — the fix is a policy layer.
deepfirstsearch.com/x402-sca…
Your AI agent pays over x402. Does its client check WHO it's paying?
Unguarded, the base client signs to any payee, any price, any network.
Scan yours free with x402-scan — the fix is a policy layer.
deepfirstsearch.com/x402-sca…
Keep your wallet. Agent Safe checks payee, price and budget before Turnkey, Privy, Coinbase CDP or Openfort is asked to sign, and its payers never sign transactions. Open source on npm.
x402-scan now grades a buyer client in one command — no wiring:
npx @deepfirstsearch/x402-scan client @x402/fetch
It attacks the client (swapped payee, fake decimals, no price cap) and grades what it signs. No funds, nothing settled.
deepfirstsearch.com/x402-sca…
x402-scan: a free, MIT scanner for x402 buyer clients — the code an AI agent uses to pay.
Attacks your client (swapped payee, fake decimals, no price cap) and grades what it falls for.
npx @deepfirstsearch/x402-scan lint <url>
github.com/DeepFirstHQ/deepf…
Proof of concept: a Safe gives an AI agent an x402 budget through Zodiac Roles. The role allows only USDC.transfer to the owner's payer addresses within a daily allowance. Attacker payee, over the cap, approve and delegatecall are refused on-chain, on a Base fork.
For x402 sellers: a guarded buyer doesn't have to erase your attribution. agent-pay 0.9.0 echoes only the extensions the owner allows, so your Base Builder Code (ERC-8021) reaches settlement. Payee, amount, asset and network never change.
Some x402 sellers hand out a new payTo on every 402. With a pinned payee, every one is refused (payee_mismatch) and nothing is signed. Honest limit: those sellers can't be paid this way yet. What the owner could pin instead is an open design question.
The seller writes the 402, including the URL it claims to be. Agent Safe pins the payee to the origin your agent actually contacted. A different declared origin goes to the audit log as declaredOrigin and is never used to decide.
New in agent-pay 0.10.0: dryRun. Point it at a seller and get the policy's verdict with no key and nothing signed: allow, deny with a code (payee_mismatch, over_cap, unknown_merchant), or no_challenge. Audit sellers before any key exists.
No receipt came back. Does your agent pay again? With Agent Safe it resends the same proof while it's valid, then asks USDC whether it was used. Used means paid, not delivered: report it, never re-sign. One authorization, never a second.
AI agents can now research markets, buy data and act on their own. The real risk isn't a bad trade: it's an agent talked into sending your money somewhere you never chose.
How we'd set up a team of agents that invest within limits the model can't change.
Not a mockup. An Agent Safe on Base Sepolia paid a real x402 endpoint, settled by the public facilitator, inside limits its owner signed.
57 contract tests, 5 against a Base mainnet fork, 50 SDK tests. Open source, MIT.
deepfirstsearch.com