PayPal AI Agent

An AI agent that prepares your money — and cannot move it: you approve every payment in PayPal. And beyond smart money — this is where your capital multiplies, through crowdfunding in Venezuela.

Comment

Inspiration

For some time now, I’ve had the idea of creating an AI agent capable of handling e-commerce—trying to envision what the next evolution of our current systems might look like. Although this form of e-commerce is not yet established, there is no doubt that the future will be driven by AI agents.

What it does

PayPal AI Agent is a powerful agentic platform that enables users to make online purchases through their own AI assistant, ensuring error-free transactions with no unauthorized expenses. Users can instruct their agent via voice commands, allowing it to efficiently conduct web searches and present the best options to choose from. But that’s not all; it also introduces an innovative, crowdfunding-style business model designed to finance ventures in Venezuela—one of the world’s most challenging economies. This serves a dual purpose: it offers an escape from inflation while supporting local business ventures, allowing users to grow their capital in USD and stimulate the economy.

Challenges we ran into

A missing number became a blank cheque. Early on, a request with no amount had the parser fill the ceiling with the account balance — and the strip offered a $3,999 motorcycle for a jacket. The fix is now a first-class behavior: with no amount named, the gateway asks before it reads a single product — no search, no row — in the language the request was written in. That refusal became one of the things the product is proudest of.

  1. PayPal's sandbox taught us the real limits. example.com payees are accepted at createOrder and refused at authorize with TRANSACTION_REFUSED (422) — so the recipient now travels inside the order, where PayPal enforces it. And the payer's approval can only happen in PayPal's own checkout, so we designed around that truth instead of hiding it: the human click is the last step by design, and the server creates every order (PayPal's guidance is unambiguous: never create orders in the browser).
  2. Gemini latency and regions are product decisions. gemini-3.8-flash measured 5.7 s to 142 s per call on the same prompt where gemini-3.8-flash-lite answered in 720 ms – 2.2 s — and model/region are not independent choices (404s taught us flash answers from global while gemini-3.8-live only from us-central1). All verified against the real SDK, on the deployed project.

Accomplishments that we're proud of

The whole chain works against a real PayPal sandbox, end to end — including the one step no code can perform: a human approving in PayPal's checkout. Real ids, printed on the project's Final Notes page (order 3LL9669283585604Y, authorization 1WU26270J4621264S).

  • The refusal before the search. No amount → a question, no catalog read, no row. The agent cannot spend a number nobody said — enforced on the server, not in the prompt.

What we learned

The primitive already existed. PayPal's authorize → capture → void is the purchase-order split. The missing layer in agentic commerce isn't another rail — it's standing consent with bounds, and sixty years of B2B purchasing already named it.

  • Capability is not the bottleneck; interruption is. Taking AP2 literally means signing forty times a day. Consent has to scale per policy, not per transaction, or the agent becomes unusable exactly where it should shine.
  • The model declares, the server decides. Structured output gets a valid envelope; only the server can judge it. Keeping those two apart is what let the voice, the buttons and the agent loop share one set of rules without any of them being trusted.
  • Real API quirks become design decisions. Latency decided which model runs where; sandbox refusals decided where the recipient lives; a deprecated ScriptProcessorNode pushed us to AudioWorklet.
  • Designing for Venezuela changes what money means. A bimonetary economy where savings are dollars and spending is bolívares turned "a balance" into something that needs a shield, a rate with a source, and an exchange that doesn't ask you to trust a stranger.

What's next for PayPal AI Agent

Real subscriptions — wire createSubscription / cancelSubscription to the schedule the recurring screen already drafts and judges.

  • Authentication and CSRF — the store endpoint is open today (it only holds two demo arrays); auth is the gate before anything more sensitive exists.
  • AP2-style cryptographic consent — a signature over the approved policy instead of a UI click, and NVIDIA OpenShell isolation so the agent runs in a sandbox with approved endpoints as network policy and credentials injected only for those.
  • The merchant side — a UCP-shaped manifest a seller agent can verify, closing the loop this build opens.
  • Full-duplex voice — streaming microphone and an interruptible agent over WebSocket; today it's push-to-talk on purpose.
  • The Venezuela thesis, grown — more real businesses through crowdfunding with audits behind the grades, and the USD ↔ VES exchange moved from preview to a connected rail: a market of billions a month that currently runs on Zelle and handshake trust is exactly where PayPal's hold primitive should be working.

Built With

Share this project:

Updates

Submission history