AI can exchange currency, order food, and access Kamino. No one controls the keys, and the race for agent payments has begun.

Written by: Forbes

Translated by: AididiaoJP, Foresight News

MoonPay founder and CEO Ivan Soto-Wright tried it himself first: he asked Claude to help him book a flight ticket. The flight got booked, the ticket was issued, and the payment was made. The entire process stayed within the chatbox without opening a checkout page.

The CEO first had Claude book his own flight, and his next goal is the user's wallet. Soto-Wright stated plainly to reporters: PayBox allows intelligent agents like Claude and ChatGPT to hold cards and crypto wallets and complete payments, while the private keys are not controlled by any single party.

This is not a demonstration show. It corresponds to a year-long competition for positioning among payment companies and model vendors — the conversation has shifted from "giving advice" to "being able to place orders." Whoever securely embeds money in the chatbox first will be closer to the next generation of checkout systems.

The missing kilometer in the chatbox

Over the past year, Claude and ChatGPT have been able to check flights, compare hotels, create shopping lists, and write investment memos. The sticking point has always been the same: when it comes to payment, the user still has to open the browser, log into their account, and click confirm. OpenAI once experimented with instant checkout within chat but later retracted; more products stop at "I've found it for you, you go buy it yourself."

What PayBox aims to fill is this last mile. Launched on July 29, the entry point is paybox.sh. Its official positioning is as a payment vault for AI: intelligent agents can transact on the open internet without users having to leave the conversation or entrust their funds to AI or platforms. The connection method is a custom connector within Claude and ChatGPT. By August 31, it also integrated Grok, with the team stating that the connection took only about two days — once standardized connectors are deployed, scaling on the model side will be quick.

Users can issue commands in natural language, such as "Deposit $100 to buy PYUSD," "Convert $100 PYUSD to SOL," "Bridge funds to Robinhood Chain," "Maximize yield using Aave," "Help me book a flight," "Reserve a dinner table for tonight." AI is responsible for research, price comparison, and preparing transactions, and funds will only move with the user's approval via a passage key.

By the next day after launch, MoonPay claimed that paybox.sh had garnered 224,000 sign-ups and even called it "the fastest-growing product in the crypto×AI space," even stating "it might be maxing out Claude." The numbers were announced unilaterally by the company, making it hard to verify, but it at least illustrates that embedding wallets into an interface already used by hundreds of millions daily is easier to scale than creating another standalone app.

Simultaneously holding cards and on-chain wallets in the vault

PayBox includes two types of critical elements needed when an agent truly spends money. One type is payment cards: agents can initiate payments but cannot see or store the original card numbers; card transactions follow Visa’s payment intermediary agreements. The other type is crypto wallets: users can create new wallets or import existing ones, with funds coming from current wallets or depositing via card after a one-time identity verification with MoonPay.

The launch primarily supports Solana, alongside Ethereum, Hyperliquid, Tempo, Base, Robinhood Chain, Arbitrum, Polygon, and other EVM-compatible networks. The payment layer connects to x402 — a machine payment standard initially open-sourced by Coinbase, now governed by the x402 Foundation under the Linux Foundation. Servers use HTTP 402 to request money from agents, and agents can settle in stablecoins instantly, without needing to open accounts, subscribe, or go through checkout. When the foundation formally operates in July 2026, founding members will include Visa, MasterCard, American Express, Stripe, Shopify, AWS, Google, Circle, with MoonPay itself on the list.

Consumer scenarios connected on the launch day included: AgentRes.dev for restaurant reservations, Purch.xyz for shopping, BRIJ.fi for flight bookings. Users can also exchange, cross-chain, or deposit funds into Aave. On August 27, it connected with the Solana lending protocol Kamino, qualifying users can make deposits to earn yields and borrow USDC using collateral directly from the conversation. This is not about creating a new lending product; it simply integrates Kamino’s existing market into the chatbox. Currently, it's unavailable in the U.S., U.K., EU, and Australia; asset and jurisdictional restrictions will be refined further. After Grok integration, these limitations have not been lifted.

There are two levels of permissions. One is "Always Ask," requiring the passage key for every transaction. The other is "Autonomous Mode," where AI can only act within limits and rules set by the user. Changing permissions must be re-approved by the user, and authorizations can be revoked anytime. A key statement emphasized repeatedly by the company is: AI can research, compare, and devise all day, but money only moves according to the user's rules.

Key segmentation is the fulcrum of the entire narrative

Agent payment fears three main things: a stolen certifiable document usable everywhere, a card number that can be repeatedly charged after being leaked, and a single-point system that can be breached to transfer funds.

PayBox provides a very specific answer. Wallet keys are split using threshold cryptography (MPC) and placed in a hardware-isolated Trusted Execution Environment (TEE). No single party, whether it's MoonPay, AI agents, or user phones, can reconstruct the full private key or sign transactions individually. If a phone is compromised, the lost key pieces are not in the same location at all. Each approval of the passage key is only effective for one transaction, becoming invalid after use, making it impossible to replay or widen privileges after interception.

This foundation originates from MoonPay's acquisition of the Israeli key management company Sodot for about $100 million in all-stock earlier this year. Sodot claims to protect over $50 billion in assets and over 10 million wallets for cryptocurrency companies. Layering on top of MoonPay’s platform servicing over 1,700 corporate clients forms the infrastructure behind every vault.

The official description of this design is "autonomous but not custodial." Existing products often force users into a binary choice: if they want agents to place orders themselves, they must entrust the funds to the platform, agent, or managed wallet. PayBox’s design means that whether it’s MoonPay or AI, none can independently use funds or credentials. There are no terminals, no custodial handoffs, and no closed marketplaces.

This is certainly not risk-free. Prompt injections, phishing dialogues, and supply chain attacks can still allow users to approve funds "within limits." The vault can prevent "having the keys stolen in bulk," but it cannot stop "a person being misled and confirming themselves." The autonomous mode shifts the approval authority forward; convenience and risk are two sides of the same coin.

This year, MoonPay is really moving payments into conversations

PayBox did not emerge out of nowhere. In March 2026, the company released an open wallet standard for AI agents, supported by PayPal, Ethereum Foundation, and Solana Foundation. In May, users could buy tokens within ChatGPT but still had to jump to a checkout page. In June, the desktop application MoonAgents directly connected Claude Code and Codex to wallets, exchanges, and prediction markets. In June, it also acquired the AI bookkeeping agent Entendre, integrating the reconciliation, treasury, and closing processes behind stablecoin transactions. Additionally, there were plans for stablecoin infrastructure for enterprises and Mastercard virtual cards for agents spending stablecoins.

On July 29, PayBox launched for Claude and ChatGPT. In August, it integrated Cash App for deposits and onboarded Kamino into the vault. By August 31, it expanded to Grok. The path is clear: first, secure deposits, then facilitate transactions in conversations, then integrate lending and yield, and finally deploy the same vault framework to more assistants.

The company has a sizable presence. Founded in 2019, it serves over 30 million users across 180 countries and has over 1,700 business clients, covering deposits and withdrawals, trading, commerce, and stablecoin infrastructure. Its licenses include New York BitLicense, New York Limited Purpose Trust License, multi-state money transmission licenses in the U.S., and EU MiCA authorization. Former CFTC acting chair Caroline Pham has joined as Chief Legal and Compliance Officer. Regulatory narrative and product narrative are intertwined: once agents can hold cards and crypto, the compliance layer must keep pace.

The entire race involves more than just MoonPay

By the summer of 2026, agent payments will transition from PPT to launch. Card organizations will explore licensed networks: Visa promotes trusted agent protocols and intelligent commerce, while MasterCard advocates Agent Pay for Machines, substituting tokenized certificates for raw card numbers. Model vendors will focus on checkout: OpenAI and Stripe jointly open-sourced the Agentic Commerce Protocol, which governs the shopping cart layer. Google has AP2 managing authorization and intent proofs. Coinbase has provided x402, governing "one HTTP request per checkout," with settlements primarily in stablecoins.

These protocols do not entirely conflict; they overlay on different layers. x402 handles small, on-demand machine-side settlements; ACP manages consumer checkouts; AP2 verifies "is this money authorized by the individual?" Gartner provided figures that large companies would use for budgeting: by 2028, B2B purchases initiated by agents may reach $15 trillion. Meanwhile, independent analyses have cast doubt — the total transaction numbers appearing large on x402 seem misleading; the actual daily active amounts may be significantly lower than advertised, with a considerable portion being self-transactions and volume manipulation.

MoonPay's positioning is quite nuanced: it neither builds a closed marketplace nor merely creates a checkout button within a specific model but instead establishes a layer that can be plugged into multiple assistants that functions as a non-custodial vault, integrating both card and chain tracks. Soto-Wright’s statement, which has been repeatedly quoted by various media outlets, almost serves as the slogan for the entire narrative:

"Cards hid cash, phones hid cards. Now we’ve entered the era where money disappears into conversations. Billions of AI agents are about to go live, each of which needs to securely hold, transfer, and spend funds. Someone has to establish a layer of trust for this world. We just did it. PayBox is the product MoonPay was meant to create."

Flight booking is just an entry point

The reason flight booking is highlighted in the title is that it is sufficiently routine. Users can relate more to “let Claude buy the ticket” than “have the agent maximize yields on Aave.” However, what the product truly seeks to unlock is the subsequent series: exchanging currency, cross-chain transferring, entering lending pools, paying merchants, and automatic execution within limits.

The current penetration rate remains thin. Features like Kamino are unavailable in major jurisdictions; Grok requires users to add the connector themselves, autonomous mode's maximum cap is subject to individual risk management, and the actual commercial scale of x402 does not match the grand narrative. However, retreating from this direction is now challenging. Assistants are no longer just asked "which flight is cheaper," but rather "help me buy one."

The CEO has already purchased a ticket. The product is now open to Claude, ChatGPT, and Grok. The remaining questions are very practical: when the chatbox starts interacting with wallets, will users be willing to relinquish approval rights; and whether this design of "no one exclusively holding keys" can truly maintain the balance between convenience and loss of control in real traffic.