Minder

How Minder works

PayPal Buyer Protection covers an order that never arrives or is not as described. It was built for people, who notice problems after delivery. An AI agent's worst losses happen earlier: a store page talks it into an order you never wanted, and that order arrives exactly as described. PayPal's terms exclude an item that was properly described but that you did not want (Buyer Protection). Minder stops those orders before the money moves, and files the claims PayPal does cover.

Where the gap is

A store page tricks the agent into extra items, more units or a different productPayPal: Usually not covered: the order arrives as describedMinder: Blocked before PayPal is asked to pay
The agent overspendsPayPal: Not a Buyer Protection case: the payment was authorizedMinder: Your limits, enforced in code; over your threshold, PayPal holds the money until you approve
The agent buys a gift cardPayPal: Gift cards are not eligibleMinder: Never paid, by your rule
The order never arrivesPayPal: Covered: Item Not ReceivedMinder: Noticed, claimed, negotiated, and escalated to a PayPal dispute
It arrives damagedPayPal: Covered: Significantly Not as DescribedMinder: Claim filed with evidence; you choose the refund or the dispute

PayPal decides each claim itself; the middle column summarizes its published terms.

Why PayPal

Minder works for the buyer, and PayPal is where the buyer has their own account, their own protection and their own controls. A payment processor that only serves merchants has none of that. Each part of Minder rests on one of them.

Let an agent pay without handing it a cardA saved permission the owner approves once in PayPal, and can remove from their PayPal account at any time. PayPal tells Minder, which then stops paying.
Ask the owner before money movesAn authorization: the money is held in the owner's PayPal, captured only if they approve, released if they decline.
Get money back when an order goes wrongBuyer Protection, refunds and disputes.
A record nobody has to take on trustWebhooks with signature checks, APIs that read every payment, refund and dispute back, and each order's custom_id, which carries the fingerprint of Minder's signed receipt for it.
The store's side of the dealPayPal's Agent Toolkit, which the stores' agents use to refund and to answer disputes.

PayPal is building agentic commerce for merchants: Agent Ready lets them accept payments from AI assistants, and Store Sync makes their catalogs discoverable (PayPal). Both serve the merchant. Minder is the buyer's side of the same transaction, and it covers the gap Buyer Protection leaves, starting with the order an agent was talked into.

One purchase, from request to recovery

Each step names the PayPal API it uses. Everything here runs on the live site, in the PayPal sandbox.

  1. 1Before the money moves

    1. An agent asks to pay

      ShopBot, or any agent connected over MCP. Agents can only ask.

    2. Your rules, in code

      Budgets, the ask-me threshold, blocked stores and gift cards. No prompt can change them.

    3. AI review

      Compares the order with your own words and the store page, which it treats as untrusted. It can only make a decision stricter.

    4. A signed receipt

      Minder writes the decision down and signs it before PayPal sees the order. The order carries the receipt's fingerprint.

      PayPal: Orders v2 custom_id

  2. 2When it moves

    1. Approve: PayPal pays

      Paid at once from the PayPal you connected once.

      PayPal: Vault v3, Orders v2 CAPTURE

    2. Hold: PayPal holds it

      The money is reserved, not taken. You tap Pay or Decline.

      PayPal: Orders v2 AUTHORIZE, then capture or void

    3. Block: nothing is sent

      No PayPal order exists, and you see why.

  3. 3After it moves

    1. PayPal reports back

      Payments, refunds and dispute changes arrive as notifications, each checked with PayPal.

      PayPal: Webhooks, verify-webhook-signature

    2. Minder chases problems

      A late or damaged order gets a claim with an evidence timeline.

    3. The store's agent answers

      It refunds or accepts the dispute through PayPal's own agent tools.

      PayPal: PayPal Agent Toolkit

    4. You decide

      Accept the offer (a PayPal refund) or escalate (a PayPal dispute), then block the store.

      PayPal: Payments v2 refund, Disputes v1

What keeps it safe

The AI never touches the money
Only Minder's server code calls PayPal. Agents cannot capture a hold, accept a refund or escalate a dispute.
You approve the risky ones
Above your threshold, or when the review is unsure, PayPal holds the money until you decide.
Store pages are untrusted
Page text that tries to steer an AI agent counts as manipulation: the purchase is blocked or held.
Code checks the AI
Every AI answer must match a schema, and the stricter of your rules and the AI's view wins.
No AI, no payment
If no model answers, anything not already blocked waits for you.
Every decision is signed
Each decision and each money move goes into a receipt book: signed, and chained to the receipt before it. Anyone can check it offline, and claims and disputes cite it.

Every threat, its defence and its test are listed in the threat model, and every AI role in how Minder uses AI.

Why this matters now

  • Guardio Labs, August 2025

    Asked to buy an Apple Watch, an AI browser bought one from a fake store and filled in the saved card, without asking.

  • Microsoft Research, November 2025

    In a simulated marketplace, prompt injection redirected AI agents' payments to manipulative sellers. The researchers' conclusion: oversight is critical for high-stakes transactions.

  • PayPal, October 2025

    PayPal launched agentic commerce services so merchants can take payments from AI agents, with buyer protection and dispute resolution on the merchant side.

  • OWASP, 2025

    Prompt injection is the top risk for LLM applications, with no fool-proof fix. Recommended: least privilege, human approval for risky actions, separating untrusted content, and checking output in code.

Try ShopBot, or try to trick itSource code and READMEThe 60-case exam: run it yourselfThe receipt bookLatest test reports