I Told an AI Agent to Rob My Store. It Found 39 Ways to Do It
Six of the 39 were severity-1. Not one was a payment bug.
I run scvd.store, a small storefront where the customers are AI agents and the money is USDC over x402. Between September 5 and 8, I pointed Codex at my own live checkout and gave it one instruction. Not "find bugs." Something narrower and meaner:
Take my money and give me nothing. Or give me the wrong thing. Do it through the front door.
It came back with 39 findings across five payment rails. As I write this, 53 of the 81 repair steps are committed and 28 are open, three of the six SEV-1s among them. The full log, with IDs and reproduction steps, is public.
The cryptography did its job every single time. Signatures verified. Replays were caught. Amounts matched to the atomic unit. Every one of the 39 lives aroundthe payment, in code...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
