MoonPay Just Put a Crypto Wallet Inside Claude and ChatGPT. The Hard Part Isn't the Payment.

On July 29, MoonPay launched PayBox, a payment vault that plugs into Claude and ChatGPT and lets them complete transactions — buy something, book a table, execute a crypto trade — inside the conversation. Not draft the transaction. Complete it.

The phrase that carried it across crypto and agent-developer circles was autonomous mode: an assistant spending money within limits you set, without asking you each time. That is the part worth slowing down on, because the failure mode of an AI that can spend is categorically different from the failure mode of an AI that can recommend. A bad recommendation is an annoyance. A bad on-chain transaction is final.

What PayBox actually does

The user flow is deliberately unremarkable. You install PayBox as a connector in Claude or ChatGPT, register a passkey, and fund the vault from an existing wallet or a card. From then on the assistant can initiate payments against it.

Two permission models govern what happens next. In the default, every transaction surfaces for explicit human approval. In autonomous mode, the assistant transacts freely inside a spending limit you define. Critically, moving between the two is itself a privileged operation: changing permission levels requires a fresh human passkey signature, and access can be revoked at any moment. That design choice matters more than it sounds — it means an assistant that has been manipulated cannot quietly widen its own authority.

On the asset side, PayBox supports crypto transactions across Solana and Ethereum-compatible networks — eight chains at launch — and routes card payments through Visa's agentic commerce protocol. Live integrations at launch are thin and concrete: Amazon purchases, Resy restaurant reservations, flight bookings.

The security design, and what each choice defends against

MoonPay's architecture is non-custodial, and the specific mechanism is multi-party computation. Rather than a single private key living somewhere, the key is split into shares distributed across hardware-isolated trusted execution environments. No single party — MoonPay included, and the AI assistant certainly included — holds enough material to sign a transaction alone. The infrastructure comes from Sodot, the Israeli cryptography firm MoonPay acquired in an all-stock deal reported at roughly $100 million in late April.

Worth stating plainly: the claim that no party including MoonPay or the assistant can independently access user funds is MoonPay's own description of its system. There is no published third-party audit of PayBox as of launch. The design is the right shape for the problem; that is not the same as verified.

Each element maps to a specific attack.

• MPC key splitting across enclaves defends against a single-point compromise — a breach of MoonPay's infrastructure, or of the assistant, does not on its own yield a signable key.
• Single-use passkey approvals defend against replay. An approval captured in transit cannot be reused for a second transaction, which closes the obvious attack against any approve-once system.
• Visa's agentic commerce protocol tokenises card payments so the underlying card number is never exposed to the assistant or the merchant flow.
• Requiring a fresh human signature to change permission levels defends against privilege escalation — the assistant cannot raise its own spending ceiling.

This is a more careful threat model than most agentic-payment demos have bothered with. It is not a complete one.

x402 is the story behind the story

The more consequential fact in the announcement is a standard, not a product. PayBox settles machine-to-machine payments over x402, a protocol originally built by Coinbase that revives the long-dormant HTTP 402 Payment Required status code as a real payment primitive — a server can demand payment for a request, and a client can satisfy it programmatically, without an account, a checkout page or a human.

Coinbase no longer controls it. x402 is now governed under the Linux Foundation, with backing reported by The Block from more than twenty organisations including AWS, Cloudflare, Visa, Mastercard, Stripe, Shopify and Anthropic. That list is the signal. When the incumbent card networks, the major cloud providers and a frontier AI lab all sit behind the same payment standard, the question stops being whether agentic commerce happens and becomes which layer captures the value.

“A protocol with Visa, Mastercard, Stripe and AWS behind it is not a crypto experiment. It is infrastructure being poured while nobody was watching.”

It is also why PayBox is interesting beyond MoonPay. A consumer product on a proprietary rail is one company's bet. A consumer product on a foundation-governed rail with that backer list is an early instance of a category.

What can still go wrong

The unsolved problem is prompt injection, and no amount of key-custody engineering addresses it. Every defence described above protects against an attacker who wants to steal the key. None protects against an attacker who persuades the legitimate assistant, holding legitimate authority, to make a payment the user did not intend.

That is not hypothetical. An assistant that browses the web, reads email or processes documents is continuously ingesting text written by strangers, and the field has no reliable method for making a model distinguish instructions from its user from instructions embedded in content it is merely reading. Give that system spend authority and the injection payload stops being a data-exfiltration risk and becomes a withdrawal.

Spending limits are the honest mitigation here, which is presumably why they are mandatory in autonomous mode. A cap does not prevent the attack; it bounds the loss. Anyone enabling autonomous mode should set that cap at an amount they would be willing to lose outright, because that is the exact quantity at risk.

The irreversibility asymmetry is under-discussed. Routing an agentic purchase through Visa inherits decades of consumer-protection machinery — disputes, fraud liability shifts, reversals. Routing the same purchase over an on-chain rail inherits none of it. Two payment paths inside the same product carry radically different downside, and nothing in the interface makes that obvious to a user who just asked their assistant to book a flight.

How to read the next six months

MoonPay has said additional AI platforms and DeFi functionality arrive within a month, which will reset the product's shape almost immediately. The things actually worth tracking are structural rather than featural.

• Whether a serious third-party security audit of the MPC and passkey implementation is published, and what it finds.
• Whether the first significant prompt-injection loss against an agentic wallet becomes public — and how the vendor characterises liability when it does.
• Whether x402 adoption broadens past crypto-native merchants into ordinary commerce, which is the threshold between standard and niche.
• Whether regulators treat an AI-initiated payment as authorised by the user. Consumer payment law largely assumes a human at the moment of authorisation, and autonomous mode removes exactly that.

That last one is the sleeper. The engineering question of how to let a model spend money safely is being answered competently and in public. The legal question of who is responsible when it spends wrongly has barely been asked.