Vitalik Buterin unveils privacy focused AI agent using Tor and zkAPI

Ethereum co-founder Vitalik Buterin has developed an open-source privacy system for AI agents that combines Tor routing, anonymous payments and locally processed prompts to reduce the exposure of user information when accessing large language models.

In an X post, Buterin said he had built a “paranoid mode” for his AI agent harness, pi, using zkAPI, random cover traffic and a local language model to rewrite requests before they reach an external AI provider.

Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi):

Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI… pic.twitter.com/2y236zA0cw

— vitalik.eth (@VitalikButerin) October 16, 2026

The setup runs through a daemon compatible with the OpenAI API, allowing the privacy features to operate as a separate layer between the agent and the language model service.

Buterin has published the relevant code on GitHub, although he acknowledged that the system introduces substantial delays and remains vulnerable to certain forms of traffic analysis.

Vitalik Buterin’s AI privacy system uses separate Tor circuits

According to Buterin’s technical description, each AI conversation receives a separate Tor circuit, while requests are mixed with random cover traffic to make network activity harder to distinguish.

Tor routes internet traffic through multiple relays to conceal the origin of a connection. In Buterin’s implementation, the separate circuits provide network isolation between conversations.

The additional cover traffic is intended to make it more difficult for an observer to identify actual AI requests based on communication patterns.

Payment privacy is handled through zkAPI, which Buterin said prevents users from exposing their identities through payment information when accessing AI services.

The system includes a local prompt rewriting mechanism. Before a request reaches the external language model, another model running on the user’s device processes the original text.

Buterin described the feature as a bring-your-own-local-model arrangement, allowing users to select the model responsible for rewriting their prompts.

His own setup uses qwen3.8-flash-next, according to the post.

Local rewriting provides a separate layer of protection from the network routing and payment components. However, Buterin did not claim that rewritten prompts eliminate every possibility of identifying a user through the information they submit.

The implementation brings these functions together inside a daemon that supports the OpenAI API interface, allowing the agent to send requests through the privacy wrapper.

Sandbox restrictions add another layer of isolation

Beyond network routing and prompt processing, Buterin has placed the pi agent harness inside a bubblewrap, or bwrap, sandbox.

Bubblewrap is a Linux sandboxing utility that can restrict a program’s access to parts of its operating environment.

Buterin said he was experimenting with MicroVM technology as another isolation option, although the post did not establish that the MicroVM setup had become part of the finished implementation.

The sandboxed agent is wrapped with torsocks, a utility that directs supported network connections through Tor.

According to Buterin, the arrangement is intended to ensure that the agent’s network activity passes through Tor instead of making direct connections.

The technical design therefore addresses several separate sources of potential information exposure, including network connections, payment records, prompt contents and the environment in which the AI agent operates.

Buterin demonstrated the arrangement using a simple research task and said the software was becoming usable for practical work.

“It’s getting quite usable!” he wrote, while acknowledging that users still face considerable latency.

He singled out the beginning of a new conversation as a particularly slow part of the process.

The post did not provide benchmark results, average response times or a comparison against an unprotected version of the same agent.

Tor protection remains vulnerable to coordinated traffic analysis

Despite the additional privacy measures, Buterin acknowledged that Tor was not an ideal network for the system he had developed.

He said the random cover traffic offered reasonable protection against passive observers, but identified a more difficult threat involving cooperation between an AI provider and a Tor guard relay.

A guard relay is the first relay used by a Tor client to enter the network.

In the scenario Buterin described, an AI provider working with the guard could actively manipulate the timing of requests and responses to identify patterns in the traffic.

Such coordination would make the random cover traffic substantially less effective, according to his assessment.

Buterin argued that this type of application would benefit from a specialized mixnet, a privacy network designed to make it harder to connect incoming and outgoing communications through traffic analysis.

His proposed approach would involve a higher bandwidth requirement and constant cover traffic built directly into the network.

Constant cover traffic would mean generating additional network activity even when users were not making genuine requests, instead of relying only on randomly inserted traffic.

Buterin did not announce a working mixnet implementation or provide a timetable for developing one.

His comments described the network as a potential technical improvement over the current Tor arrangement, which he characterized as an imperfect solution for protecting AI interactions.

zkAPI payment costs are expected to fall on Ethereum

Buterin ended his update with a separate development concerning the cost of using zkAPI.

He said significantly cheaper gas costs for zkAPI deposits and withdrawals were coming to the Ethereum mainnet soon.

The statement did not specify the expected reduction in transaction costs, the mechanism responsible for the savings or a deployment date.

Deposits and withdrawals are separate from the network privacy functions in the agent wrapper, which uses zkAPI to address the possibility of identity exposure through payments.

Buterin’s post did not identify which external language model providers had been used in his demonstration or disclose the total cost of running the combined privacy tools.

The announced gas cost changes remain pending, with no confirmed mainnet activation date provided in the post.

Earlier zkAPI work provides context for Buterin’s latest experiment

The latest implementation follows an October 1 launch by the Ethereum Foundation and Open Anonymity Project, which introduced zkAPI as a payment system for metered services.

According to the Foundation’s technical announcement, users deposit funds into an Ethereum vault and authorize later API usage through zero-knowledge proofs.

The system can issue short-lived API credentials with spending limits, allowing a single authorization to cover multiple requests during a session.

Payment authorization and prompt delivery are handled separately. The payment service verifies spending rights without receiving the conversation, while the model provider processes the prompt without being given the user’s funding identity.

The Foundation acknowledged that the payment mechanism does not independently conceal IP addresses or information contained in prompts. Those limitations were examined in an October 2 analysis of zkAPI privacy.

On October 4, Buterin tested a three-layer setup using personal health and travel information to generate diet and exercise recommendations.

As crypto.news previously reported, the earlier experiment used a local Qwen model to decide what information should be shared with remote AI services. Buterin reported processing speeds of approximately 20 to 30 tokens per second and said speeds exceeding 100 tokens per second would be preferable.

Ethereum’s work on autonomous agents includes ERC-8004 identity infrastructure, which was scheduled for a January 2026 mainnet rollout. The standard provides registries for agent identity and reputation, a separate function from the private payment authorization handled by zkAPI.

Buterin’s latest post describes additional controls around the earlier privacy arrangement, including conversation-specific Tor circuits, random cover traffic and sandbox restrictions.