Ethereum co-founder Vitalik Buterin has outlined an experimental privacy framework for artificial intelligence agents that layers anonymous payments, network anonymization, and on-device prompt handling.
The approach, which he describes as a “paranoid mode” wrapper around his personal agent harness, aims to limit the exposure of user identities and sensitive details when agents interact with external language models.
The system is packaged as a daemon compatible with the OpenAI application programming interface. Inside it, three distinct protections operate together.
First, every conversation is assigned its own circuit on the Tor network.
Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi):
Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI… pic.twitter.com/2y236zA0cw
— vitalik.eth (@VitalikButerin) October 16, 2026
Requests are further obscured by the injection of random cover traffic, which is intended to make genuine queries harder to distinguish from background noise on the basis of timing or volume.
Second, payment for model usage is handled through zkAPI, a protocol developed with involvement from the Open Anonymity Project and the Ethereum Foundation.
zkAPI allows a user to maintain a private balance and prove, via zero-knowledge proofs, that sufficient funds exist for a request without linking that request back to a specific on-chain deposit or wallet identity.
Third, prompts are rewritten on the user’s own machine by a local language model before they leave the device.
Buterin has indicated he uses a Qwen 3.8 Flash Next model for this step, so that stylistic markers and potentially identifying wording can be altered prior to transmission.
The agent harness itself runs inside a bubblewrap sandbox, with additional experiments underway involving MicroVM isolation.
The entire environment is then wrapped with torsocks, forcing all outbound connections through Tor.
In a short demonstration, Buterin asked the agent to perform a simple research task—identifying vegan restaurants in Tallinn—and reported that the stack returned usable results.
He characterized the overall experience as increasingly practical, while noting that the added layers introduce noticeable latency, particularly when a new conversation begins and a fresh Tor circuit must be established.Buterin has also flagged remaining limitations.
He observes that Tor, while helpful against passive observers, is far from ideal for this use case.
Cover traffic offers only modest protection if an AI service provider colludes with a Tor entry (guard) node and actively manipulates timing patterns.
In such scenarios, he suggests that a purpose-built mix network, accepting higher bandwidth overhead and continuous cover traffic, would be more appropriate.
Separately, he notes that substantially lower gas costs for zkAPI deposits and withdrawals are expected to arrive on Ethereum mainnet in the near term, which could enlarge the anonymity set available to users.
The arrangement offers a concrete illustration of how AI-powered agents might access remote models while reducing the linkage between prompts, network metadata, and payment credentials.
It does not eliminate all possible leakage paths, nor does it claim to replace the need for stronger anonymity systems in the long run. The code for the daemon and related components has been made available for inspection, allowing others to examine, test, or adapt the design.
