x402 SDK flaw let malicious APIs drain AI agents' token balances

V12 found 25 flaws in the Coinbase-created x402 payment SDKs, three rated critical, including a default client with no spending limit that let agents sign away their full token balance. The x402 Foundation fixed all three on August 18 but published no security advisory, and npm audit and PyPI still show no warnings.