Key Highlights
- Vitalik Buterin described a “paranoid mode” for AI agents that combines Tor routing, zkAPI, cover traffic, local prompt rewriting, and sandboxing.
- The setup assigns separate Tor circuits to conversations and uses random cover traffic to make request patterns harder to analyze.
- zkAPI separates payment from identity by using private Ethereum deposits and zero-knowledge proofs to authorize metered API usage without directly identifying users.
Ethereum co-founder Vitalik Buterin has described a privacy-focused AI agent setup that combines Tor circuits, zero-knowledge payment proofs, cover traffic and local prompt rewriting.
In an X post on October 16, Buterin outlined wrapping an open-AI-compatible daemon with zkAPI, Tor, extra cover traffic, and local LLM prompt rewriting. He applied the configuration to his AI agent harness, called pi, and described the setup as ‘paranoid mode.’ Each conversation is assigned a separate Tor circuit. Requests are masked with random cover traffic.
zkAPI handles payments without linking identity. Prompts are rewritten locally using a model such as qwen3.8-flash-next. The agent harness itself runs inside a bwrap sandbox, with experiments involving MicroVM, and is further wrapped with torsocks so all activity routes through Tor.
Buterin shared an example of the system performing a simple research task and noted that the setup has become more usable, though it incurs higher latency, particularly when starting a new conversation.
zkAPI separates payment from identity
According to the official blog post on October 1 by the Ethereum Foundation, zkAPI allows payment for a metered API without revealing identity. Users deposit credits into an Ethereum vault once. They then authorize bounded usage with zero-knowledge proofs rather than an identity. The provider sees the requests. The payment layer sees the spend. Neither learns the link between them.
The Open Anonymity Project developed zkAPI with the Ethereum Foundation. It operates on Ethereum Mainnet. Deposits become private notes in a Merkle tree. Spending generates a nullifier to prevent double-spending. Proofs use Groth16 on the BN254 curve and Poseidon hashes. The vault contract allows users to withdraw funds on-chain independently of any server.
In the runtime-key mode, a client on the user’s device submits a proof of payment. The server issues a short-lived, capped API key held only in memory. Prompts then go directly to the AI provider with that key. Usage is settled later via a signed receipt against the private balance. A proxy mode also exists in which the zkAPI server relays requests.
Network and content limitations noted
Buterin observed that Tor is not optimal for this use case. Cover traffic provides some protection against passive adversaries but is weaker if the LLM provider colludes with a Tor guard and manipulates timing. He stated that such tasks would benefit from a more specialized mixnet that accepts a higher bandwidth multiplier and includes constant cover traffic.
zkAPI addresses the payment link but does not provide network anonymity or content privacy by itself. A stable IP can allow correlation of request patterns. Users can route through Tor with a fresh circuit per session. Prompt contents, writing style, or reused details can still serve as fingerprints for the inference provider. Local or trusted execution environment models can help by generating requests from shared memory. Cheaper deposit and withdrawal gas costs for zkAPI are expected on the mainnet soon.
Context of broader AI and privacy concerns
The development follows recent comments by Buterin on AI’s effects on cryptography and blockchain privacy. On October 8, he advised against rushing to move funds to new wallets over possible AI-accelerated mathematical breakthroughs that could affect cryptographic systems. He suggested that keeping funds in an unused address can be a sensible step if convenient, while noting the need to consider AI-accelerated attacks alongside quantum computing risks.
At the OKX NOW 2026 Summit in Singapore on October 6 during TOKEN2049 week, Buterin described AI as a potential primary interface for interacting with blockchains. He indicated that this shift would relocate some risks rather than remove them.
At the 12th Global Blockchain Summit on September 23, Buterin said that keeping a person’s real name away from transactions is no longer sufficient. AI and data analysis tools can examine public blockchain information more effectively, reducing the privacy once provided by pseudonymous addresses.
The new agent configuration applies these privacy considerations directly to AI interactions, where prompts often contain personal details about health, finances, or other matters. By combining network routing through Tor, payment separation via zkAPI, and local prompt handling, the setup seeks to limit linkage between usage, identity, and content.
Also Read: Solana Shanghai Event Postponed in China as Registrations Quadruple, Police Reported
