MoonPay CEO and founder Ivan Soto-Wright started with a simple test case: he asked Claude to book a flight for him. The assistant compared options, selected a fare and completed the payment without sending him out of the chat window to a separate checkout page.
That demo points to a larger ambition. Soto-Wright said PayBox is built so agents such as Claude and ChatGPT can hold cards and crypto wallets and make payments, while no single party controls the private keys behind those funds.
This is not just a product stunt. Over the past year, payments companies and model developers have been chasing the same shift: moving chat interfaces from recommendation tools to places where transactions actually happen. The company trying to embed money safely inside the conversation gets closer to owning the next checkout layer.
PayBox is aimed at the last step missing from chat commerce
Claude and ChatGPT can already search flights, compare hotels, compile shopping lists and draft investment memos. The friction has been the same: once payment is required, the user usually has to open a browser, log in and confirm the purchase manually. OpenAI previously experimented with instant checkout inside chat and later pulled back, while many other products have remained at the stage of “we found it for you, now go buy it yourself.”
PayBox is trying to close that gap. The product launched on July 29 through paybox.sh. MoonPay describes it as a payment vault for AI, one that lets agents transact across the open internet without forcing users to leave the conversation or hand custody of funds to the AI or the platform.
Connection happens through custom connectors inside Claude and ChatGPT. On Aug. 31, PayBox was also added to Grok. The team said the Grok integration took about two days, arguing that expansion on the model side should speed up once standardized connectors are in place.
Users issue natural-language commands such as “deposit $100 to buy PYUSD,” “swap $100 of PYUSD into SOL,” “bridge funds to Robinhood Chain,” “maximize yield with Aave,” “book me a flight,” or “reserve dinner for tonight.” The AI handles research, price comparison and transaction preparation. Funds only move after the user approves the action with a passkey.
One day after launch, MoonPay said paybox.sh had reached 224,000 signups and called it the fastest-spreading product in crypto and AI. The company even said it “may have maxed out Claude.” That figure came from MoonPay itself and is difficult to verify independently, but it does suggest that placing a wallet inside interfaces used by hundreds of millions of people each day may be easier to scale than launching yet another standalone app.
The vault combines cards with onchain wallets
PayBox is built around the two tools an agent needs to actually spend money.
- The first is a payment card. Agents can initiate a transaction, but they cannot view or store the raw card number. Card payments run through Visa’s agent commerce framework.
- The second is a crypto wallet. Users can create or import one, then fund it from an existing wallet or by using a card after a one-time identity check through MoonPay.
At launch, onchain support included Solana and EVM-compatible networks such as Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum and Polygon.
On the payments side, PayBox plugs into x402, the machine-payment standard originally open-sourced by Coinbase and now governed by the x402 Foundation under the Linux Foundation. In that setup, a server requests payment from an agent through HTTP 402, and the agent can settle instantly with stablecoins instead of opening an account, subscribing first or moving through a traditional checkout flow.
By the time the foundation formally began operating in July 2026, its founding members already included Visa, Mastercard, American Express, Stripe, Shopify, AWS, Google, Circle and MoonPay.
At launch, PayBox connected to several consumer use cases: AgentRes.dev for restaurant reservations, Purch.xyz for shopping and BRIJ.fi for flight bookings. Onchain functions included swaps, cross-chain transfers and moving funds into Aave. On Aug. 27, MoonPay also integrated the Solana lending protocol Kamino, allowing eligible users to deposit assets for yield or borrow USDC against collateral from inside the chat interface.
MoonPay said this was not a new lending product. It was an interface layer on top of Kamino’s existing markets. The feature is unavailable in the United States, the United Kingdom, the European Union and Australia, and access also depends on the specific asset and jurisdiction involved. Those restrictions remained in place after Grok support was added.
Two permission modes, with the user still controlling approval
PayBox offers two levels of permissions.
- In the first mode, every transaction requires a passkey confirmation.
- In the second, called autonomous mode, the AI can act only within limits and rules preset by the user.
Any change to permissions requires fresh approval from the user, and authorization can be revoked at any time. MoonPay’s repeated message is straightforward: the AI can research, compare prices and structure a plan all day, but funds only move according to user-defined rules.
MPC and TEE sit at the center of the security design
Agent payments carry three obvious risks: a stolen credential that can be reused widely, an exposed card number that can be charged repeatedly, and a single point of failure that can unlock the whole pool of funds if compromised.
PayBox’s answer is to split wallet keys with multi-party computation, or MPC, and place the shards inside hardware-isolated trusted execution environments, known as TEEs. MoonPay, the AI agent and the user’s phone each hold part of the system, and no one party can reconstruct the full private key or sign a transaction alone.
If a phone is compromised, the missing key fragments are not sitting in the same place. Each passkey approval applies to only one action and expires after use. Even if intercepted, it cannot be replayed or expanded into a broader permission set.
MoonPay traces that architecture back to its April acquisition of Israeli key-management company Sodot in an all-stock deal worth about $100 million. Sodot has said it protects more than $50 billion in assets and more than 10 million wallets for crypto companies. Combined with MoonPay’s base of more than 1,700 enterprise clients, that acquisition forms the infrastructure behind each vault.
The company describes the model as “autonomous but non-custodial.” Many existing products force users into a trade-off: if they want an agent to transact on its own, they have to hand money over to a platform, an agent or a custodial wallet. PayBox is designed so neither MoonPay nor the AI can move funds or credentials unilaterally. There is no handoff into terminal custody and no closed marketplace wrapped around the experience.
That does not remove risk altogether. Prompt injection, phishing-style conversations and supply-chain attacks could still push a user into approving payments that stay within their configured limits. The vault can reduce the chance that “the whole key ring gets stolen at once.” It cannot stop someone from being manipulated into pressing approve. Autonomous mode moves that decision point earlier, and convenience and exposure rise together.
MoonPay has been moving payments into chat for months
PayBox did not appear out of nowhere. MoonPay has spent the past year pushing payments into conversational interfaces.
In March 2026, the company introduced an open wallet standard for AI agents with backing from PayPal, the Ethereum Foundation and the Solana Foundation. In May, crypto purchases became available inside ChatGPT, but users still had to jump to a checkout flow. In June, the desktop app MoonAgents connected Claude Code and Codex directly to wallets, swaps and prediction markets. That same month, MoonPay acquired AI accounting agent Entendre, bringing reconciliation, treasury and closing workflows for stablecoin payments under the same roof. During the same period, the company also worked on stablecoin infrastructure for enterprises and on plans for Mastercard virtual cards that AI agents could use.
On July 29, PayBox launched with Claude and ChatGPT. In August, the company added Cash App funding and brought Kamino into the vault. On Aug. 31, it expanded to Grok. The sequence is clear: first on-ramping, then transactions inside chat, then lending and yield products, and finally distribution of the same vault across more assistants.
Scale, licenses and the compliance angle
MoonPay was founded in 2019. The company says it serves more than 30 million users across 180 countries and has more than 1,700 enterprise customers. Its businesses span on-ramps, off-ramps, trading, commerce and stablecoin infrastructure.
Its licenses include a New York BitLicense, a New York limited purpose trust charter, money transmission licenses across multiple U.S. states and authorization under the European Union’s MiCA framework. Former acting Commodity Futures Trading Commission chair Caroline Pham has joined the company as chief legal and administrative officer.
That matters because MoonPay is tying its product story directly to compliance. If agents are going to hold payment cards and digital assets, the regulatory layer has to keep pace.
MoonPay is not alone in the race for agent payments
By the summer of 2026, agent payments had moved from pitch decks to live products.
Card networks are leaning on licensed payment rails. Visa has introduced trusted agent protocols and agentic commerce tools. Mastercard has launched Agent Pay for Machines, using tokenized credentials instead of exposed card numbers. Model companies are tackling checkout from another layer: Agentic Commerce Protocol, open-sourced by OpenAI and Stripe, focuses on the cart and checkout flow. Google’s AP2 addresses authorization and intent proof. Coinbase’s x402 handles a different problem, settling one HTTP request at a time, usually in stablecoins.
These standards do not completely clash. They stack across different layers of the transaction flow. x402 handles machine-native micropayments and pay-per-request settlement. ACP manages consumer checkout. AP2 is designed to verify whether the payment was actually authorized by the user.
Gartner has put out a figure that large companies are already using in planning decks: B2B purchases initiated by agents could reach $15 trillion by 2028. At the same time, independent analysis has also cast doubt on parts of the narrative. Transaction counts on Base tied to x402 may look large in cumulative terms, but actual daily active dollar volume could be far lower than promotional framing suggests, with a meaningful share potentially coming from self-dealing and wash activity.
MoonPay has taken a narrower and more unusual position. It is not building a closed marketplace, and it is not limiting itself to a checkout button inside a single model. It is trying to provide a non-custodial vault that can plug into multiple assistants while supporting both card rails and onchain rails.
One quote from Soto-Wright has been repeated widely by the press and now functions as the company’s thesis statement: 「Cards hid cash. Phones hid cards. Now money is disappearing into conversation. Billions of AI agents are coming online, and every one of them will need to hold, move and spend funds safely. Someone has to build the trust layer for that world. We just did. PayBox is the product MoonPay was born to build.」
Flight booking is only the doorway
Flight booking made the headline because it is easy to grasp. People can immediately understand what it means to ask Claude to buy a ticket. Asking an agent to optimize yield on Aave is a less intuitive consumer story.
But the product’s real target is much broader: swapping tokens, bridging assets, entering lending pools, paying merchants and automating a chain of transactions within user-set limits.
For now, adoption remains thin in practical terms. Kamino features are unavailable in major jurisdictions. Grok users still need to add a connector themselves. Autonomous mode depends on how much risk each user is willing to allow, and the real commercial scale of x402 still does not fully match the size of the surrounding narrative.
Even so, the direction looks difficult to reverse. Users are no longer asking assistants only which flight is cheapest. They are starting to ask them to buy it.
Soto-Wright has already had Claude purchase a ticket. PayBox is now available for Claude, ChatGPT and Grok. The next questions are more concrete: whether users are willing to hand over approval power once chat interfaces touch their wallets, and whether a system built so that no one party holds the entire key can keep the line between convenience and loss of control intact under real traffic.