Vitalik Buterin pushes the confidentiality of his AI agents very far. The co-founder of Ethereum has just unveiled a “paranoid mode” combining Tor, private payments via zkAPI, fake network traffic and local prompt rewriting. Each conversation goes through a different Tor circuit. Even the AI provider’s payment is designed to no longer directly reveal the user’s identity.
In brief
- Vitalik Buterin combines Tor, zkAPI and a local AI model.
- Each conversation uses a separate Tor circuit and cover traffic.
- Buterin recognizes that his system remains slower and still imperfect.
Vitalik Buterin pushes AI privacy even further
This is not the first time that Vitalik Buterin has expressed concern about the safety of agents. In April, he already warned about the risks linked to AI agents and defended more local treatments and isolated environments. His new montage goes further. Buterin uses Pi as an environment for his AI agent. Around it, he added several layers intended to prevent a model provider from easily reconstructing the identity of the person sending the requests.
Each new conversation receives its own Tor circuit. Additional random traffic is generated to make real requests harder to distinguish in the network flow. The prompts then pass through a locally executed model, which can rephrase them before passing them to the remote model.
Buterin indicates using Qwen3.8-Flash-Next for this step, while specifying that other models can take its place. The whole thing works behind a service compatible with the OpenAI API. The idea is to be able to add these protections without rebuilding all the software that already uses this interface.
Ethereum also hides the payment of AI agents
Tor doesn’t solve everything. A user can hide their IP address, then reveal their identity a few seconds later simply by paying their supplier with a named account or an API key associated with their bank card.
This is where zkAPI comes in. The tool was launched on October 1 by the Open Anonymity Project with the Ethereum Foundation. It allows you to deposit ETH or USDC in a vault on Ethereum, then obtain private usage credits.
Zero-knowledge proofs are used to demonstrate that a user has sufficient credit without revealing which deposit specifically funds their request. The AI provider always receives the prompt. However, it does not directly obtain the payment identity hidden behind the temporary key.
This approach corresponds quite well to the vision that Buterin has been defending for several months to bring Ethereum and AI closer together. Its system still adds local protection. The Pi agent runs inside a Bubblewrap sandbox to limit its access to the rest of the operating system. Its connections go through Tor with torsocks. Buterin is also testing micro-virtual machines to reinforce this isolation. Not really a standard setup for using a chatbot.
“Paranoid mode” still remains imperfect
Buterin does not present his assembly as a definitive solution. First problem: speed. He explains that the configuration becomes usable, but the latency remains noticeably higher, especially when starting a new conversation. Tor, new circuits, local processing and different layers of confidentiality come at a cost.
The Tor network itself also has limitations. An AI provider working with a Tor input relay could attempt to analyze or manipulate the timing of requests to bring certain connections closer together. Fake traffic complicates analysis, without making it impossible.
Buterin believes that a specialized mixnet, with more continuous coverage traffic, could better address this problem. His experiment comes at a time when Ethereum is already using AI in the other direction. The Foundation deployed AI agents to search for flaws in the protocol’s code, with at least one real vulnerability identified and then fixed. Agents therefore become more useful. They also get more access to files, the network, payments and sometimes wallets. Buterin prefers to assume that all these layers can ultimately reveal something. Hence the name: “paranoid mode”.
Maximize your Tremplin.io experience with our ‘Read to Earn’ program! For every article you read, earn points and access exclusive rewards. Sign up now and start earning benefits.
