Ethereum co-founder Vitalik Buterin has outlined a privacy-oriented configuration for artificial intelligence agents that layers multiple protective measures to reduce the risk of identity and data exposure. The approach, which he calls “paranoid mode,” integrates the zkAPI payment system, the Tor anonymity network, randomized cover traffic and local processing of prompts.

Buterin described the setup in a post on X on October 16, 2026. It is built around his Pi agent harness and operates as an OpenAI-compatible daemon, allowing it to work with existing AI tools while adding privacy features.

How the Privacy Layers Work

Each conversation is assigned a separate Tor circuit so that network activity from one session cannot be easily linked to another. Outbound traffic is routed through Tor using torsocks, and additional random cover traffic is generated to mask genuine requests and disrupt timing patterns.

Before any prompt reaches an external AI service, a locally running large language model rewrites it. Buterin is currently using the Qwen3.8-Flash-Next model for this step, though the system supports other local models. The rewriting aims to remove stylistic fingerprints and other identifying details that could otherwise link prompts to a specific user.

The agent itself runs inside a Bubblewrap sandbox that restricts its access to the host operating system. Buterin is also experimenting with micro-virtual machines for further isolation.

Anonymous Payments Through zkAPI

Payments for AI services are handled through zkAPI, a system launched on October 1 by the Ethereum Foundation and the Open Anonymity Project. Users deposit cryptocurrency such as ETH or USDC into an Ethereum-based vault and receive private credits. Zero-knowledge proofs allow them to demonstrate sufficient funds without linking individual requests back to the original deposit or wallet.

Temporary API credentials with spending limits are issued so that AI providers never see conventional billing identities tied to the user’s activity. zkAPI alone does not hide the content of prompts or network metadata, which is why Buterin combined it with Tor routing and local rewriting.

Remaining Limitations

Buterin noted that the configuration has reached a usable stage but still carries performance costs. Latency rises noticeably when a new conversation begins because a fresh Tor circuit must be established.

He also cautioned that Tor’s protections can be weakened if an AI provider colludes with a Tor entry node and actively manipulates timing. Randomized cover traffic helps against passive monitoring but is less effective against such coordinated attacks. Buterin suggested that a purpose-built mixnet offering continuous cover traffic and higher bandwidth would provide stronger resistance in those scenarios.

Separately, he indicated that gas costs for zkAPI deposits and withdrawals on Ethereum mainnet are expected to fall substantially, though he did not give a specific timeline or figures.

Broader Context for AI Agents

The experiment comes as autonomous AI agents are increasingly able to hold digital assets, interact with on-chain protocols and make payments. Buterin has previously stated that such agents could eventually replace traditional wallets and front-end interfaces, with blockchains coordinating their interactions. The privacy stack he described is intended to keep wallet activity, prompt content and network metadata from being linked in ways that would compromise users.

The setup remains experimental. Buterin presented it as a personal configuration rather than a finished product, while inviting further development of stronger anonymity tools suited to AI agent workloads.