x402 Just Got a Standards Home. Who Conformance-Tests the Authority?

Short summary

The Linux Foundation launched the x402 Foundation on July 14, 2026 to govern the protocol enabling AI agents to pay each other over HTTP 402, with major payment industry players as members. However, the launch includes no conformance suite, security profile, or certification program — standardizing the receipt format but not adversarial testing of payment authority claims. The author argues this mirrors the MCP pattern where protocol maturity outpaced security testing, and that vendor-neutral adversarial conformance testing is the critical missing layer.

• •x402 Foundation launched under Linux Foundation with Visa, Mastercard, Stripe, Coinbase and others as members
• •No conformance suite, security profile, or certification program shipped at launch — only the receipt format is standardized
• •Research on MCP tool-description attacks (ShareLock, 90%+ success rate) shows why isolated format validation is insufficient against composite adversarial attacks

Generated with AI, which can make mistakes.