Most "AI can pay for you" demos skip the only question that matters: what stops the agent from emptying your account? MoonPay PayBox, launched July 29, 2026, is the first mainstream answer worth studying. It lets ChatGPT and Claude prepare and execute real payments — and it keeps a human with a passkey as the last, load-bearing step. If you're a founder thinking about agents that transact, this is the reference design to read before you build your own.
What it is#
PayBox is a non-custodial payment vault that plugs into your AI assistant. Three words carry the weight.
Non-custodial: you hold the keys, not MoonPay. Under the hood it uses multi-party computation (MPC) to split your wallet keys across hardware-isolated secure enclaves, so that no single party — not MoonPay, not the AI, not any one server — can move funds alone.
Payment vault: it holds the ability to pay across two lanes at once — crypto on Solana and Ethereum-compatible (EVM) chains, and cards through Visa's agentic-commerce protocol for real-world purchases like Amazon orders, restaurant reservations, and flights. The agent never touches raw card numbers.
Assistant-connected: you add PayBox as a custom connector inside ChatGPT or Claude, then just describe what you want. The assistant researches and prepares the transaction; you approve it with a passkey before anything settles.
Who it's for#
PayBox is aimed at the individual who wants their own assistant to do the buying — book the flight, pay the invoice, swap the token — without handing a model a blank check. It's a consumer product, not a backend SDK. If your instinct is "I want my ChatGPT to handle the boring transactions, but I want to sign off before money leaves," you are exactly the target user.
How to start#
- Open ChatGPT or Claude and add PayBox as a custom connector.
- Authenticate and set your permission level — start with approve every transaction.
- Fund or connect the vault (crypto on Solana/EVM, or a card for agentic-commerce purchases).
- Ask in plain language: "Book me a table for two at 7pm Friday" or "Send 0.2 SOL to this address."
- The assistant prepares the transaction; approve it with your passkey. Nothing moves until you do.
Only after you've watched it behave should you consider raising the permission to autonomous within a spending cap — and even then, keep the cap low.
What it costs#
The vault and the AI connection are the consumer product; MoonPay has not published a separate PayBox subscription fee. What you pay is the usual transaction economics — crypto network fees, card-processing costs, and MoonPay's standard on/off-ramp margin where you convert. Read the in-product fee disclosure before you transact, and don't assume "free" just because there's no tool subscription.
The honest catch#
Two cautions, both important.
It's a wallet, not a platform primitive. PayBox is for a person delegating spend to their own assistant. It is not a server-side SDK for wiring autonomous payments into your product's backend. If you're building agent-initiated payments as a feature, treat PayBox as a competitor and a reference design — then reach for programmatic rails like x402 or Visa's and Stripe's agentic-commerce APIs.
Any payment rail an agent can trigger is a new attack surface. A prompt-injected or confused agent that can propose a transaction is only safe because it can't complete one alone. So the guidance is blunt: keep spending caps tight, keep passkey approval on, and treat that passkey as the single most important control in the system. The moment you turn it off for convenience, you've rebuilt the exact risk PayBox was designed to remove.
For the wider context on why "agents that can pay" became a category this week — and where it sits next to the reactors VCs are funding to power all of it — see this week's Founder's Wire.
