MoonPay has launched PayBox, a payment vault for ChatGPT and Claude that lets AI assistants execute approved financial actions from within a conversation.

The product is designed to close a gap that has limited AI agents until now. An assistant can find a token, compare swap routes, identify a paid data service or locate a restaurant, but typically stops at the financial step and hands the user off to a separate wallet, exchange or checkout page.

PayBox connects payment authority directly to the assistant, allowing it to carry out an approved action in chat. Users install it as a custom connector, register a passkey and fund the vault from a bank account or crypto wallet.

The scope extends beyond crypto. Fortune reported that PayBox supports Amazon orders, Resy restaurant reservations and flight bookings through an agent-facing service called Brij, alongside token swaps and DeFi interactions. Card payments route through Visa’s agentic commerce protocol, keeping the raw card number out of the agent’s hands entirely.

PayBox as a permission layer

MoonPay describes PayBox as an “agents-first credential vault.” Users connect wallet keys, payment methods or other credentials once, then decide which agent can access them and what actions it may perform.

The security model relies on key splitting. According to MoonPay’s announcement, wallet keys are divided using multi-party computation across hardware-isolated enclaves, leaving no device, session or party — MoonPay and the AI agent included — able to sign alone. If a phone is compromised, an attacker would only obtain fragments that are too incomplete to use.

The infrastructure comes from Sodot, a key-management company MoonPay acquired earlier this year, which it says already secures more than 10 million wallets.

The distinction matters because “non-custodial” can refer to different designs. MoonPay’s earlier agent tooling kept private keys on the user’s own device. PayBox instead distributes fragments across enclaves, reducing single-device compromise as a failure mode while creating a dependency on the enclave infrastructure.

Funds move directly between the user’s funding source and the merchant, wallet, protocol or recipient. When an agent requests an approved wallet operation, PayBox returns a signature, signed message or transaction hash. For card payments, it supplies a limited token or virtual card.

PayBox also connects to self-custodial wallets, where MoonPay cannot reset or reconstruct the private keys. The user retains control and also bears the full responsibility for securing access.

Passkeys and spending rules

Delegating money to an assistant carries different consequences from asking it to summarize a document. A wrong answer can be corrected; a wrongly signed onchain transfer usually cannot.

PayBox places authorization rules between the assistant and the funding source. Access is protected by a passkey, with each approval scoped to a single action and expiring after use, so a captured or replayed approval should remain useless.

MoonPay says separate permission settings apply to each connected agent across three broad levels:

• Approval for every action: the assistant prepares the transaction, and the user authorizes it.
• Approval above a limit: smaller transactions proceed automatically, while larger ones require confirmation.
• Autonomous operation within boundaries: the agent acts independently inside a defined amount, network, service or permission scope.

Approval is tied to the specific operation presented. If the recipient, amount or other details change, PayBox requires fresh authorization. Users can also revoke an individual agent’s access or trigger a kill switch to suspend every connected agent if a device or credential appears compromised.

Authorization, not just security

One clause in MoonPay’s terms deserves attention beyond the security architecture itself. An operation submitted under a valid permission counts as authorized by the user, whether or not the user reviewed it.

That follows from autonomous mode. A permission system that requires human review of every action would defeat the purpose of granting the permission in the first place. It also shifts the risk in a way that marketing language does not fully spell out.

A practical example is straightforward: if a user grants an agent authority to spend up to $200 on API access and the agent spends it poorly, every transaction remains valid under the permission granted. The loss sits with the user, even if they never reviewed the individual transactions.

Card payments retain some recourse through chargebacks. Onchain transfers settle permanently, so the autonomous tier carries different consequences depending on which rail the agent uses. A user can set a generous crypto limit without necessarily confronting that distinction.

Crypto payments, swaps and paid APIs

PayBox stays out of execution when an agent requests a swap. It passes the authorized instruction to the connected wallet, protocol or trading service, and the result depends on liquidity, the smart contract used, the quoted price and the chosen network.

The initial blockchain rollout covers Solana and EVM-compatible networks, placing Ethereum, Base and Arbitrum in the same technical environment, although available assets and services differ between them.

Multi-chain support matters because agent payments serve different purposes. A consumer purchase may use a card or bank-funded credential, while a swap requires an onchain wallet. Payments for data, compute or individual API calls are better suited to stablecoins, since conventional checkout systems handle amounts worth only a few cents poorly.

How x402 enables API payments

PayBox integrates with x402, an open payment standard built around the HTTP 402 “Payment Required” response.

The process folds payment into a normal request between an agent and an online service:

1. The agent requests access to an API, dataset, article or other digital resource.
2. The service returns a 402 response containing the price, payment asset, network and destination.
3. The agent checks whether the payment fits within its approved PayBox limits.
4. PayBox supplies the authorized signature or payment credential.
5. The agent resubmits with proof of payment and receives the resource.

The service does not need to create a customer account, sell a subscription or ask the agent to preload credits. Each request carries its own price, payable in stablecoins on supported networks.

As Coindoo previously noted in its analysis of stablecoins as a possible payment rail for AI agents, x402 is designed for machine-to-machine commerce. Software discovers a service, reads its price, pays within an approved budget and consumes the result without stopping for a human checkout.

The standard governs how a service requests payment and how an agent proves it, while the wallet, stablecoin and settlement network remain variable and nothing routes through MoonPay by default.

Not first, but structured differently

Agent funding tools already exist. Fortune noted that Robinhood and Coinbase both offer ways to give agents spending capacity, with MoonPay’s distinction being decentralization and independence from the company’s own permissions.

That difference is real, but narrower than it may sound. A user still depends on MoonPay’s enclave infrastructure, on the connector remaining available inside ChatGPT and Claude, and on the company’s terms governing what a valid permission authorizes. Decentralized key management removes one dependency while leaving the platform in place.

Limits of the model

PayBox addresses the authorization problem more directly than the judgment problem.

An agent may be allowed to swap up to $100 of USDC while still selecting the wrong token contract, accepting poor execution or interacting with a malicious protocol. A reservation can land on the wrong date. An API payment can buy data that misses the point of the request. Each is properly authorized and still a bad outcome.

Coverage also has limits. A service must expose an agent-accessible payment route, connector or x402 endpoint before an assistant can transact with it. Funding a wallet does not make an ordinary website compatible.

Controlled delegation is therefore the realistic early model. Small, repetitive and tightly bounded transactions fit the autonomous tier; larger swaps, unfamiliar contracts and irreversible transfers remain better suited to manual approval.

PayBox moves AI assistants closer to acting inside crypto rather than merely describing it. Whether that becomes a meaningful payment market will depend on how many wallets, protocols, APIs and merchants adopt compatible connectors, and on whether users trust an agent enough to let it sign.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment or legal advice. Descriptions of PayBox’s security architecture and permission model reflect MoonPay’s own published statements and have not been independently tested. Users should review the current product terms before granting an AI agent spending authority.

Methodology: This article uses MoonPay’s launch announcement, Fortune’s reporting on PayBox’s consumer integrations and competitors, the published x402 specification, MoonPay’s product terms and Coindoo’s earlier coverage of stablecoin payment rails for AI agents.