Five hard x402 payment cases for Claude Sonnet and Haiku. Without instructions, both agreed to pay in a token two swapped digits away from real USDC.
Not reliably, in our test. We put five hard x402 payment cases to Claude Sonnet and Claude Haiku, with no extra instructions. In the first one, the token contract in the seller's terms differed from real USDC on Base by two swapped digits, a lookalike USDC contract. Both models said the agent should pay, and Sonnet called the address the canonical USDC contract. In a separate case, Haiku also approved paying for a product its agent had never requested. When we loaded our skill and ran those three cases again, each answer became a refusal that named the field that was wrong.
Read the full report on AISkills402: https://aiskills402.com/blog/ai-agent-lookalike-usdc
Top comments (1)
This matches what we see on chain. We watch every Base wallet that has made an AI-agent payment, and 368 of them received address-poisoning transfers in the last 7 days (as of 11 Oct): small or zero-value transfers that plant a lookalike address in the wallet's history, waiting for someone, or something, to copy it. Confirmed losses from those wallets are still small (2 payments, $60 in total), but your test shows how that could change once agents, not people, read the payment terms.
Question: does your skill compare the token contract to a fixed per-chain list, or does it ask the model to check it? The first holds against two swapped digits; the second is what failed here. And did either model check the payTo address with the same care, or only the token?
( Agentic Finance Graph, an independent ledger of AI-agent payments on Base.)