Is this safe? What can go wrong, and what can't?

Honest answer in three parts. What can't go wrong, if it's set up correctly: your agent cannot exceed the spending cap you gave it — that's enforced by the wallet, not by trust. Doing nothing is always safe; an unanswered payment request just expires. What has gone wrong in the ecosystem: security researchers have documented real attacks across x402 implementations — replay attacks (reusing a payment proof twice), front-running, and grant-before-settle bugs — including a signature-verification bypass disclosed in March 2026. These are implementation bugs, not flaws in the protocol's design, but they're real, and they're why 'audited code' isn't a buzzword here. What AWM did about it: before this exact vulnerability class made ecosystem news, our Phase-1 security audit found and fixed the same category in our own payment path — every authorization is bound to the specific payer's wallet, every payment proof can be claimed by exactly one rental atomically, and replays are rejected. We publish that not to brag but because 'is this safe' deserves specifics, not vibes. The remaining honest risks: unaudited third-party services, and the general rule that on-chain payments are final — there's no chargeback department. Spend caps and escrow exist precisely because of that finality.