https://warns.xyz/blog/ Field notes from the wrong side of an agent's wallet. en https://warns.xyz/blog/why-a-spend-cap-is-not-a-security-layer/ https://warns.xyz/blog/why-a-spend-cap-is-not-a-security-layer/ Wed, 23 Sep 2026 09:00:00 GMT The x402 client (@x402/core 2.26) ships with a 1 USD default cap per payment. On Base, 98 payments out of 100 fit under it. So does every attack we built. Here is what we measured, and what a real decision looks like.