120 million. That's how many AI-assisted payment transactions Alipay processed in a single week during February 2026, according to NielsenIQ's July report "The Commerce Revolution: Where East Meets West." The number comes directly from Ant Group's production logs — live volume from its AI Pay service, transactions initiated by AI agents through Qwen App integrations and smart devices, mostly for food and beverages, without human confirmation at checkout. A receipt from a system already running at scale.

The distance between that number and what agentic commerce looks like in Western markets comes down to one missing piece: the payment layer. The most recent Forrester analysis puts 19% of U.S. consumers actively using AI agents for purchases. ChatGPT Shopping connects to over a million Shopify merchants. Google AI Mode serves a billion users. The discovery rails exist. What's been missing is infrastructure that lets an AI agent execute a transaction without requiring the user to hand over control of their money.

That changed on July 29, 2026. MoonPay launched PayBox.

What PayBox Is

PayBox is a non-custodial payment vault that connects directly to Claude and ChatGPT via custom connectors, allowing users to authorize AI agents to execute financial transactions — crypto trades, merchant payments, travel bookings, DeFi operations — through plain-language conversation. The agent never holds your funds. It never sees your card number in its raw form. And it cannot move a dollar beyond parameters you set and can revoke at any time.

The product is live at paybox.sh, available immediately to MoonPay's 30 million customers across 180 countries, with support for 1,700+ enterprise clients on the underlying infrastructure.

CEO Ivan Soto-Wright framed the launch with a line that may be the most-quoted in fintech this year: "The card hid the cash. The phone hid the card. This is the era where money disappears into conversation."

Each transition in that framing was a UX discontinuity so profound that most consumers adopted it without fully understanding the infrastructure change underneath. Cards abstracted cash into rails. Phones abstracted cards into tokens. Conversation abstracts both into intent. PayBox is the infrastructure bet that intent is the last layer.

The Architecture That Makes Non-Custodial Agentic Payments Possible

The central problem of agentic payments — and the reason no one had solved it cleanly for consumer-facing AI platforms before now — is the custody paradox. To let an AI agent buy something on your behalf, it needs access to payment credentials. But giving credentials to an AI system means giving them to software that could theoretically be manipulated, hallucinated into unauthorized spending, or compromised.

Most early attempts resolved this by either (a) limiting agents to read-only shopping and routing to human checkout, or (b) having users load funds into a hot wallet the agent controls entirely. Neither is satisfying for mainstream use.

PayBox resolves the paradox through multi-party computation (MPC), powered by MoonPay's April 2026 acquisition of Sodot, an Israeli crypto security firm, in a $100 million all-stock deal. Sodot's technology uses threshold cryptography to split private keys across hardware-isolated trusted execution environments (TEEs) — secure enclaves where code executes in isolation from the host system. No single party — not MoonPay's servers, not the AI model, not the user's device — ever holds a complete private key. Signing a transaction requires a quorum across these distributed enclaves.

The practical result: an AI agent can prepare a transaction and request approval, but it cannot execute one unilaterally. The architecture is audited by Trail of Bits and NCC Group, PCI DSS compliant, and running at proven scale — Sodot's infrastructure already secures more than $50 billion in assets across more than 10 million wallets for clients including eToro, BitGo, Flow Traders, and Exodus.

For traditional card payments, PayBox routes through Visa's agentic commerce protocol, which tokenizes card details so the AI never stores or sees raw card numbers. Single-use passkey approvals are scoped to one action and expire after use — there are no replayable authorizations to hijack.

Two Modes, One Fundamental Shift in Control

PayBox offers two operating modes that together define a new design language for agentic finance:

Always Ask requires a fresh passkey confirmation for every transaction. The agent prepares; the human approves. This mode suits larger or infrequent purchases where users want oversight at the action level.

Autonomous grants the agent authority to act within user-defined spending limits — a category floor, a per-transaction cap, a monthly ceiling — without requiring per-action approval. Changing the mode, or modifying any limit, always requires a fresh human passkey authorization. The agent can never unilaterally grant itself broader permissions.

This architecture is more than a UX preference. It's a direct response to regulatory concerns building since NY DFS Superintendent Kaitlin Asrow flagged agentic payments at the June 2026 NY Fed conference as a category requiring guardrails. The question of who is liable when an AI agent executes an unauthorized transaction is unresolved in most jurisdictions. PayBox's design places that question in the user's hands by making the human — via passkey — the final authority on permission scope.

Dual Rails: x402 and Visa, Simultaneously

PayBox's payment routing reflects the current two-speed architecture of agentic commerce: crypto-native machine-to-machine payments, and traditional card-based consumer transactions.

For the crypto layer, PayBox uses x402 — the open standard for agent-initiated payments incubated by the x402 Foundation, which achieved operational status via the Linux Foundation in July 2026 with 40 member organizations including Visa, Mastercard, Stripe, Google, AWS, Shopify, Cloudflare, Coinbase, and Adyen. The x402 protocol works by having a server return an HTTP 402 response with a price, the agent signs a USDC payment, and the resource is delivered. PayBox implements this across Solana and seven EVM-compatible networks at launch: Ethereum, Base, Arbitrum, Polygon, Hyperliquid, Tempo, and Robinhood Chain.

For the traditional rails layer, card payments run through Visa's agentic commerce protocol, meaning PayBox can serve the hundreds of millions of users who interact with Claude and ChatGPT without any crypto holdings at all.

This dual-rail architecture matters. Previous agentic payment solutions forced a binary choice: crypto-only (limiting user adoption) or card-only (requiring third-party handling of credentials). PayBox runs both simultaneously, allowing users to set their preferences and having the vault route accordingly. Live integrations at launch span restaurant reservations, travel bookings, major online retail, token swaps, DeFi yield optimization via Aave, and asset bridging across chains.

The Platform Convergence

PayBox launches into Claude and ChatGPT, but MoonPay's broader platform strategy is explicitly about covering all four major AI assistants. Earlier in July, MoonPay completed its integration across ChatGPT, Claude, Grok, and Perplexity as a crypto onramp — becoming the first regulated crypto on-ramp operating across every major AI platform. PayBox expands the scope from "buy crypto through AI" to "have AI execute any payment on your behalf."

The significance of that platform breadth is structural: whatever AI assistant a consumer uses, the same payment infrastructure runs underneath. This is the payment-layer equivalent of what credit card networks achieved through universal acceptance — ubiquity as a moat.

For merchants, the implication is that any PayBox-enabled user on any major AI platform becomes a potential customer through natural-language commerce, without requiring merchant-side integration for each AI platform separately.

The East-West Gap, and Why It's Closing

The Alipay AI Pay numbers are more than an impressive benchmark — they're a technical preview of what happens when agentic payment infrastructure meets consumer-scale distribution. Ant Group built AI Pay on top of its existing 1+ billion user base, integrating it with Qwen App and smart home devices, with a trust model that benefited from China's established mobile payment norms and centralized identity infrastructure.

The West is working with different constraints: stronger expectations of financial data privacy, fragmented identity systems, cross-border jurisdictional complexity, and a consumer culture that historically resists giving financial authority to automated systems. These constraints explain why Western agentic commerce volume in 2026 is measured in millions rather than hundreds of millions weekly — and why the infrastructure now being built looks so different from Alipay's centralized model.

MoonPay's response — non-custodial design, dual-rail payment routing, user-controlled policy modes, regulatory licensing across NY BitLicense and EU MiCA — reads as a product brief specifically engineered for the Western risk landscape. Where Alipay centralized trust at scale, PayBox distributes it across threshold cryptography.

The Remaining Challenges

Deploying this architecture into mainstream consumer hands is harder than the cryptographic elegance suggests.

Passkey adoption among general consumers remains uneven. Autonomous mode's value proposition — set spending limits and let the agent act — requires users to trust that those limits will hold under adversarial conditions. Akamai's July 2026 report flagged commerce as the #1 target for AI-driven cybercrime, with specific vectors including agent hijacking and signal masking. The same MPC infrastructure that prevents unauthorized signing also becomes a high-value target for sophisticated adversaries.

Regulatory clarity remains incomplete. The Warner AI AGENT Act proposes a CUA legal category and FTC registry for commercial AI agents but has not moved to a floor vote. EU AI Act compliance deadlines are live as of August 2, but agentic payment liability specifically is still being worked through guidance. MoonPay's dual licensing provides a strong baseline, but the legal scaffolding around who bears liability when an autonomous agent executes an incorrect transaction is still under construction.

The "coming soon" note on PayBox — extending to Grok, Perplexity, and future platforms — will be the real test of whether the platform-agnostic vision survives contact with each AI provider's distinct security and integration requirements.

What to Do Now

Start with merchant x402 readiness. The user base is beginning to arrive with payment capability attached. PayBox's x402 integration means any merchant with x402 checkout support is now accessible to agents on Claude and ChatGPT. The x402 Foundation's 40-member coalition — which almost certainly includes your payment processor — has the integration documentation. This is the fastest path from zero agent transactions to live ones.

Study the non-custodial architecture before building your own payment layer. Users who lose funds to agentic systems don't return. MPC threshold signing — not hot wallet custody, not card credential storage — is the architecture that survives both regulatory scrutiny and consumer trust requirements simultaneously. PayBox's connector model is available to evaluate now.

If you're in financial services: the Sodot acquisition is the playbook. MoonPay didn't build MPC infrastructure from scratch; it acquired an Israeli firm that had already proven the technology at $50 billion in secured assets. The path from "we need agentic payment security" to "we have agentic payment security" ran through M&A, not internal R&D. The window to acquire security infrastructure that's already production-hardened is narrowing as more players recognize the gap.

The 120 million weekly transactions happening in China are proof the era works. PayBox is the first serious attempt to build that era's infrastructure for markets where custody, privacy, and regulatory complexity shaped the product requirements from day one.

The card hid the cash. The phone hid the card. The vault is now open.

Sources