MoonPay launched PayBox on July 29, 2026, letting AI agents inside Claude and ChatGPT move and spend a user’s money. Its Autonomous mode lets an agent act within limits the user sets.
Key Takeaways
- PayBox installs as a custom connector inside Claude or ChatGPT, turning natural-language instructions into prepared transactions a user approves.
- Wallet keys sit behind threshold cryptography and secure enclaves, so no single party can sign a transaction alone.
- Sodot, the key management firm MoonPay acquired earlier this year, secures more than $50 billion in assets and over 10 million wallets.
- Card payments run through Visa’s agentic commerce protocol, so PayBox never sees or stores the raw card number.
- MoonPay ships two permission modes, Always Ask for approval on every transaction and Autonomous for action inside user-set limits.
What Happened?
MoonPay, the fintech company that moves value across fiat and digital assets, released PayBox as a custom connector users install inside Claude or ChatGPT. The agent prepares a transaction from a plain instruction such as “Onramp $100 into PYUSD” or “Bridge funds to Robinhood Chain.” The user approves it with a passkey, and the money moves.
The vault launched with support for Solana and EVM-compatible chains including Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum and Polygon. Through x402, the open standard for agent-initiated payments, an agent can pay any service built to accept them. Restaurant reservations, travel bookings, and shopping across major online retailers were live at launch.
Ivan Soto-Wright, CEO and Founder of MoonPay said:
No Single Party Holds the Full Key
PayBox stores two kinds of credential. Cards are held so an agent can pay with them without ever seeing card details, and wallet keys are protected by threshold cryptography (MPC) and secure enclaves (TEEs). MoonPay said “no single party, including MoonPay or the AI agent itself, can ever access the full private key or sign transactions independently.“
The key management comes from Sodot, the company MoonPay acquired earlier this year. Sodot’s infrastructure secures more than $50 billion in assets and over 10 million wallets for crypto companies, and MoonPay’s platform carries more than 1,700 enterprise clients.
MoonPay has been building toward this in public. The company released its Open Wallet Standard for AI agents in March 2026 under an MIT license, with backing from more than 15 organizations including PayPal, Circle and the Ethereum Foundation. On-chain wallets linked to AI agents passed 340,000 in the first quarter of 2026.
Closing the Three Fraud Vectors
MoonPay names three failure modes in agentic payments and maps a control to each.
- A stolen credential that works anywhere. Keys are split via MPC across hardware-isolated enclaves, so no device, session, or party holds a complete key.
- A card number that leaks and gets reused. Card payments run through Visa’s agentic commerce protocol, and PayBox transacts without ever seeing or storing the raw number.
- A system that can move funds once compromised. Every passkey approval covers a single action and expires after use, so a captured approval cannot be run again.
Both exposures are large. Global card fraud losses reached $33.83 billion in 2023, according to the Nilson Report, a loss rate of 6.58 cents per $100 of card volume. Hot wallet breaches caused about 82% of centralized exchange losses over five years.
Implications for Agentic Payments
Agentic spending arrives through several rails at once, from crypto payment gateways to card networks. The release describes an architecture, not an audited outcome. MoonPay published no third-party security assessment of the MPC and TEE implementation with the announcement, and it did not name the retailers, airlines, or booking platforms behind the live x402 integrations.
Four questions stay open. Which markets PayBox is available in, what MoonPay charges for onramps and swaps executed inside the vault, who absorbs the loss when an approved transaction turns out to be an unintended one, and whether Autonomous mode carries per-transaction or cumulative caps.
Users who install PayBox can check which permission mode is active before funding the vault, review the limits attached to Autonomous mode, and revoke access at any time. Changing permissions always requires a new passkey approval from a human user.
CoinLaw’s Takeaway
PayBox targets a narrow blocker in agentic commerce. An AI could research a purchase and prepare a transaction, then a person had to hand it off to a terminal, a developer tool, or a third-party custodian to finish it. The design keeps key material where neither the model nor the vendor can reach it, and the passkey carries proof that a human authorized one specific action.
The security case rests on implementation quality outsiders cannot yet inspect. Sodot’s record across millions of wallets for crypto companies is the strongest evidence on offer, and it says little about an agent acting on a natural language instruction. Autonomous mode is where the design gets tested, because the limits a user sets become the only check between a misread instruction and a completed payment.
