Agentic Payments & How AI Agents Actually Pay for Things

Ask an AI assistant to plan a weekend in Lisbon and it will do the whole thing. Flights compared, a hotel picked, a restaurant found, a rough budget. Then it hands you a list of links and stops, because the next step involves money, and until recently no AI could take that step.

That gap is closing. Agentic payments are the set of technologies letting an AI agent pay for things on your behalf, and 2026 is the year they went from demo to product. MoonPay shipped PayBox at the end of July, a payment vault that connects to Claude or ChatGPT and lets an AI move money it can never hold. It runs as the worked example through this article, because it answers all four parts of the problem in one place and its design decisions are documented rather than implied.

This article covers what agentic payments are, how the money actually moves, what an agent can buy today, and the security question that decides whether any of it is worth using.

In short: Agentic payments let an AI agent execute a purchase for you. The agent never holds your money or sees your card number. It prepares a transaction, you approve it with a passkey or a preset rule, and a payment vault between the agent and your funds carries it out. PayBox is MoonPay's version, holding both cards and wallet keys that an AI can spend from but never read.

What are agentic payments?

An agentic payment is a transaction initiated by software acting for you rather than by you clicking a button. You state an outcome in plain language, the agent works out the steps, and money moves at the end of it without you opening a banking app or typing a card number.

Plenty of software already moves money automatically: standing orders, subscription billing, algorithmic trading. Those follow rules you wrote in advance. An agent decides. You say "book a table for two tonight somewhere with good ramen and pay whatever deposit it needs," and the agent chooses the restaurant, finds the deposit, and pays it. You never specified which restaurant or how much.

That phrasing isn't hypothetical. It's close to the prompts PayBox shipped with, alongside things like "Onramp $100 into PYUSD," "Swap $100 of PYUSD to SOL," and "Book my flight." The interface is the chat window you already use.

You will also see this called agentic commerce, usually when the emphasis is on the shopping side rather than the payment plumbing. They describe the same shift from different ends.

Why AI couldn't pay for anything until now

The blocker was never intelligence. An assistant that can write working software can obviously fill in a checkout form. The blocker was that every available way to let it try was unacceptable.

Give an agent your card number and it becomes a stored credential inside a system you don't control. Anything that compromises the agent (a hijacked session, a malicious instruction hidden in a web page it reads, an ordinary bug) now compromises your card. Card numbers are also reusable by design, so one leak keeps paying out.

A crypto wallet's private key is worse. There's no chargeback, no issuer to call, and a key that can sign one transaction can sign every transaction.

Hand the money to a custodian instead and you've solved the leak by introducing a different problem: a third party now holds your funds and you're trusting their solvency, their security, and their willingness to give the money back.

So the design problem was how to let an agent spend money it can never hold.

The four problems any agent payment system has to solve

Different products answer these differently, but every one of them has to answer all four.

Custody

Where do the funds and credentials actually live, and who can reach them? The strongest answers put the money somewhere no single party can touch alone, including the company that built the product. Threshold cryptography, usually shortened to MPC, splits a private key into pieces held in separate secure environments so that a complete key never exists anywhere. Signing requires the pieces to cooperate. Stealing one device gets an attacker a fragment that does nothing on its own.

PayBox does this with MPC across hardware-isolated secure enclaves, using key management built by Sodot, a company MoonPay acquired earlier this year. Neither MoonPay nor the AI agent can access a complete key or sign a transaction alone. That property is the one to check first in any product in this category, because everything else is decoration if the answer is wrong.

Authorization

How does the agent get permission, and how far does that permission stretch? The important property is scope. An approval that covers one specific action and expires on use behaves very differently from a session token that quietly authorizes everything the agent does next. If an approval can be captured and replayed, it isn't much of an approval.

In PayBox every authorization is a passkey approval scoped to a single action, and it expires once used. There's no session for an attacker to capture. You also pick how much freedom the agent gets: Always Ask requires a passkey for every transaction, Autonomous lets the AI act inside limits you set. Changing those limits needs its own passkey approval, so the agent can't widen its own permissions and neither can anyone who hijacks the conversation. Access can be revoked at any time.

Rails

How does the payment clear? Card networks have built agent-specific rails so a payment can be made against a stored card without the card number ever being handed to the agent. Onchain, the rails are stablecoins and the networks they settle on, which is why so much early agentic payment activity involves USDC and PYUSD rather than dollars in a bank account.

PayBox holds both kinds. Cards sit in the vault and pay out over Visa's agentic commerce protocol, so the agent transacts with a card it never sees the number of. Wallet funds run on Solana and EVM networks including Ethereum, Base, Arbitrum, Polygon, Hyperliquid, Tempo, and Robinhood Chain.

Merchant acceptance

How does the other side know to take the payment? A restaurant's booking system has to understand that it's being paid by software and be willing to accept it. This is the newest of the four and the one currently limiting what agents can buy. PayBox reaches these merchants through x402, which is where the next section starts.

The standards taking shape

The interesting part of this problem is that no single company can solve it. An agent that can only pay merchants inside one company's marketplace is doing something much smaller than shopping the open internet.

x402 is the open standard doing most of the work here. It revives HTTP status code 402, "Payment Required," which was reserved in the original web specification and then sat unused for about thirty years. The mechanic is simple: a service responds to a request with a price instead of content, the agent pays, and the request goes through. Any service can implement it, and any agent that speaks it can pay any service that does. That openness is why payment companies built against x402 instead of a proprietary checkout. PayBox uses it for everything it pays outside the crypto rails, which is what lets it reach merchants MoonPay has no relationship with.

On the card side, Visa's agentic commerce protocol does the equivalent job for traditional payments, letting a vault present a card to a merchant on an agent's behalf without exposing the number.

Both are young. Standards in this space are being written and revised in public right now, so the specific list of what works with what is going to look different in six months.

What an AI agent can actually buy today

The answer splits sharply between onchain and off.

Onchain, the capability is already broad. Through PayBox an agent can buy crypto with a card, swap one token for another, bridge assets between networks, and interact with DeFi protocols. These work because the counterparty is a smart contract that doesn't care whether a human or a program is calling it.

Off-chain, it depends entirely on merchant adoption. PayBox launched with restaurant reservations, travel booking, and shopping across a set of larger online retailers. That list is growing weekly, and it is nowhere near "buy anything anywhere." If you connect an agent payment tool today expecting it to shop the whole internet, you'll be disappointed for a few more quarters.

The crypto side arrived first because it was already machine-readable. Traditional commerce is retrofitting.

How PayBox works

Setup takes a few minutes. You install PayBox as a connector inside Claude or ChatGPT, create an account, register a passkey, then create or import a wallet and optionally add a card. Funding comes from an existing wallet or from a card, and the card route runs MoonPay's one-time identity verification.

After that the pattern is the same every time. You describe what you want. The AI researches, compares, and prepares a transaction, showing you the amount, the payment method, and the fees before anything happens. You approve with a passkey. The money moves.

The division of labour is the part worth sitting with. The agent can plan all day and cost you nothing. Money only moves under the rules you set, and those rules can only be changed by a human holding your passkey.

MoonPay has said support for more AI platforms is coming, along with deeper DeFi capability such as routing swaps and managing liquidity, all under the same approval model.

Is it safe?

Fraud in agentic payments comes from three places, and a well-built system closes each one specifically.

The risks & how they’re closed:

• A stolen credential that works anywhere. Keys split across isolated environments so no device, session, or company holds a complete one, and no party can sign alone.
• A card number that leaks and gets reused. Card payments run over agent-specific network rails, so the agent transacts without ever seeing the raw number.
• One compromised system that can drain everything. Every approval scoped to a single action and expired after use, so a captured approval can't be replayed or widened.

The above describes PayBox's design directly, since it's the product that has published its answer to each of the three. Keys split via MPC across enclaves, cards paying over Visa's agentic rails, approvals scoped to one action and expired after use.

There's a second layer on top of custody, which is how much you let the agent do without asking. Most products offer a strict mode where every transaction needs your explicit approval, and a looser mode where the agent acts within limits you set. Check whether changing those limits itself requires human approval. If it does, then neither the agent nor anyone who compromises the conversation can quietly raise its own ceiling. PayBox requires it.

None of this makes agent payments risk-free. It makes the failure modes smaller and more contained than the alternatives, which is the standard worth judging by. And a system that has been live for weeks has less of a track record than one that has been live for years, which is worth weighing regardless of how good the architecture looks on paper.

How this differs from saved cards and autopay

A saved card is a stored credential you reuse. Autopay is a rule you wrote in advance. Both are older ideas that people reasonably confuse with this one.

Who decides what to buy

• Saved card or autopay: You, in advance
• Agentic payment: The agent, within your rules

What's stored

• Saved card or autopay: Your card details, at each merchant
• Agentic payment: Nothing the agent can read

Scope of permission

• Saved card or autopay: Ongoing, until you cancel
• Agentic payment: One action, then expired

What a breach exposes

• Saved card or autopay: A reusable card number
• Agentic payment: A key fragment that can't sign alone

What it's good at

• Saved card or autopay: Repeat, predictable spending
• Agentic payment: Open-ended tasks where you don't know the answer yet

The practical difference is that autopay handles things you already decided. Agentic payments handle things you'd rather not decide.

What to check before you connect one

If you're evaluating an agent payment product, these are the questions that separate them. Most marketing pages will answer the easy ones and skip the hard ones.

• Can the company itself move your funds without you? If yes, you have a custodian, whatever the page calls it.
• Does a complete private key exist anywhere, on any device or server? The answer should be no.
• Is each approval scoped to one action, or does approving once open a session?
• Does changing the spending limits require a fresh human approval?
• Can you revoke everything instantly, and what happens to a transaction already in flight?
• Which chains and payment methods are actually supported today, not on a roadmap?
• Who built the underlying key management, and what else does it secure?
• What's the fee, and is it visible before you approve rather than after?

Fee visibility is the one people skip past, and it's the one that costs money quietly. If you can't see the route a payment took, you have no way to judge whether it was a good one. PayBox shows the prepared transaction, including fees, before you approve it.

Run the rest of the list against PayBox and the answers are: no, MoonPay cannot move your funds without you; no complete key exists anywhere; each approval covers one action and expires; limit changes need a fresh passkey; revocation is instant; the supported chains are listed above; and the key management is Sodot's, which secures more than $50 billion in assets and over 10 million wallets for other crypto companies. Ask any competing product the same eight questions.

What agentic payments don't solve yet

Merchant coverage is the obvious limit, and it will fix itself as adoption grows. These won't.

Failure recovery is harder in this model. When a multi-step transaction breaks halfway, "where is my money right now" is a difficult question to answer if you never knew the route it was taking. Products that are good at this invest heavily in status tracking, and it's worth checking that before you need it.

Judgment doesn't come with the capability. An agent can execute a strategy perfectly and the strategy can still be a bad idea. Nothing about the plumbing improves what you asked it to do.

And there's a category of decision most people won't want to delegate no matter how safe the mechanism gets. That line sits in a different place for everyone, and the sensible approach is to find yours slowly, with small amounts, in the strictest permission mode available.

PayBox has its own version of these limits. Bitcoin isn't supported. The merchant catalogue is weeks old. Autonomous mode is only as safe as the caps you set on it, which means a careless setting is a real exposure rather than a theoretical one. And the product went live at the end of July 2026, so nobody has years of operating history with it, however well the architecture reads.

Getting started

The fastest way to understand agentic payments is to run one small transaction and watch what happens.

PayBox is live now. Install the connector in Claude or ChatGPT, register a passkey, fund the vault from a card or an existing wallet, and ask your AI to do something small. Onramping fifty dollars into a stablecoin is a good first test, because you'll see the whole flow, prepared transaction through passkey through settlement, on an amount that doesn't matter.

Start in the strictest approval mode, move a small amount, and see how it feels before you loosen anything. The category is only a few weeks old, and there's no advantage to being early to it with a large balance.

Common questions

Can an AI agent spend my money without asking? Only if you configure it to. Every serious product ships a mode requiring explicit approval for each transaction, and it's the sensible default. Autonomous modes exist, but the limits are yours to set, and on a well-designed system raising those limits requires human approval of its own.

Does the AI see my card number? It shouldn't. The point of a payment vault is that card details sit inside it and payments run over network rails built for this, so the agent transacts without ever reading the number.

What happens if my AI account gets hacked? Since no complete key exists and every approval is scoped to one action and expires after use, an attacker with access to the conversation can request transactions but can't approve them or replay an old approval. Revoking the connection cuts it off entirely.

What is PayBox? PayBox is MoonPay's payment vault for AI agents, launched on July 29, 2026. It connects to Claude or ChatGPT as a connector and holds both payment cards and crypto wallet funds, letting your AI prepare and execute transactions that you approve with a passkey. MoonPay never takes custody of the money, and neither does the AI.

Is PayBox safe? Its security rests on three things: wallet keys split with MPC across secure enclaves so no complete key exists anywhere, card payments running over Visa's agentic commerce protocol so the raw number is never exposed, and every approval scoped to a single action that expires after use. The key management comes from Sodot, which secures over $50 billion in assets elsewhere. The honest caveat is that the product is only weeks old, so its track record is short even though its architecture is conservative.

What can PayBox actually do? Onchain: buy crypto with a card, swap tokens, bridge between networks, and interact with DeFi across Solana and EVM chains including Ethereum, Base, Arbitrum, Polygon, Hyperliquid, Tempo, and Robinhood Chain. Off-chain, through x402: restaurant reservations, travel booking, and shopping with a growing set of online retailers.

Is this the same as agentic commerce? Roughly. Agentic commerce usually describes the shopping experience, agentic payments the money movement underneath it. The terms are used loosely and often interchangeably.

Do I need crypto to use agentic payments? Not necessarily, though it's where the capability is furthest along. Products in this category typically support both cards and onchain funds, because merchant acceptance for traditional payments is still catching up.