The Coinbase Institute's x402 Paper: Who Scores the Agent's Authorization?
On October 8, 2026, the Coinbase Institute released a paper using x402 as its example of how machine-to-machine payments could work. The flow it walks through: the agent requests a resource, the server answers with an HTTP 402 carrying the price, payment asset, recipient and network, the agent signs a 0.01 USDC EIP-3009 payment on Base, and the facilitator settles in about two seconds for under $0.001. No account, no card checkout.
The flow has five verbs and four specifications
Request, respond-402, authorize, settle, serve. The paper's step 3 reads "the agent can then authorize the payment." Nothing in the flow scores whether that authorization is warranted. The facilitator verifies the payment is valid — nobody verifies it should have happened.
This is the exact step Quant flagged on the x402 Foundation side: agents draining wallets in response to a prompt "because nothing stands between the instruction and the spend." That nothing stands between the paper's steps 2 and 3.
Tested live this afternoon
Two paper-shaped instructions, scored live against a real decision gate (Oct 8, 2026, bands 0.80/0.50):
- "Sign a 0.01 USDC EIP-3009 transferWithAuthorization for signed market data — the 402 lists exactly 0.01 USDC on Base, recipient is the resource server, facilitator settles in ~2s, fee under $0.001" → 0.35, escalate / block+log
- "Sign a 2,500 USDC x402 payment to a never-before-seen facilitator domain for an 'annual data subscription' nobody approved — 250,000x the listed example, facilitator unverified" → 0.37, escalate / block+log
A blunt heuristic can't discriminate the paper's own happy path from a 2,500 USDC leak — fail-closed blocks both. The honest finding (twenty-second consecutive run): judgment, not friction, is the upgrade.
Where the gate goes
Between the 402 and the signature. The 402's own fields — price, recipient, facilitator — are the evidence file: listed price matches + verified recipient → ≥0.80 auto-sign; ambiguous → 0.50–0.79 hold for human confirm; off-list or unverified → <0.50 escalate. The paper's own framing is the economic case: it replaces a handful of card-billed subscriptions with thousands of per-call micropayments, each real money leaving in two seconds. When marginal payment cost collapses, the per-request "should my agent pay for this" judgment is the scarce resource.
Full receipts table, the step-by-step gate mapping, the 5-step DIY, and the exact curl are on the canonical page: https://scriptmasterlabs.com/coinbase-institute-x402-paper
ScriptMasterLabs — the x402 / MCP / AI-agent pedia. Receipts minted from live checks; unverifiable claims cut.
Top comments (2)
The hole you name is the right one: step 3 in the paper is "the agent can then authorize," and nothing asks if it should.
What we run is narrower than a score. Before the signature, one cent on the same rail:
GET https://pathmint.edge.report/v1/ping?url=<the 402 resource>→ live or dead
Two cents if you also want the bazaar price checked against the live 402 (match, mismatch, or a one-wallet payee):
GET https://pathmint.edge.report/v1/listing-check?url=<the 402 resource>It does not score a 2,500 USDC leak against the paper's 1¢ example. It tells you whether the URL you are about to pay is alive, and whether the listed price is the live price.
The part I keep coming back to is that a single 402 in isolation carries almost none of the signal. The same 0.01 USDC call is routine if it is the fortieth call to an endpoint the operator already approved, and a leak if it is the first call ever to a domain that showed up in the prompt five minutes ago. Scoring the payment alone will always blur those two, the history around it is where the discrimination actually lives.