Ethereum co-founder Vitalik Buterin has shared a practical privacy configuration for AI agents that combines zero-knowledge API payments, Tor routing, cover traffic, and local language model prompt rewriting. In an October 16 post on X, he described wrapping zkAPI, Tor, and a local LLM into an open-AI compatible daemon and adding a “paranoid mode” wrapper for his agent harness called pi.
Inside the privacy stack
The core idea is to reduce the identifying signals an AI agent leaks during routine use. Buterin said each conversation is assigned a separate Tor circuit, while requests are masked with random cover traffic. Payment-level identity leakage is addressed by zkAPI, and prompts are rewritten locally before they are sent, using a user-supplied model; Buterin said he is using qwen3.8-flash-next. The broader context is consistent with his earlier focus on AI-driven scaling and privacy on Ethereum, as covered in Vitalik Buterin Maps Out Ethereum’s Two-Year Path Toward AI-Driven Scaling and Privacy.
Buterin also described the system-level isolation around the agent. The harness is wrapped with a bwrap sandbox, with experimentation on MicroVM isolation, and then wrapped again with torsocks so all traffic passes through Tor. This architecture connects to Ethereum Foundation work on Ethereum Foundation Launches zkAPI for Private API Payments, which aims to make private API payments practical.
The result is a working research assistant, according to Buterin. He shared an example of asking the agent to perform a simple research task and said the setup is “getting quite usable.” The privacy approach fits into his longer-running argument that Ethereum-based tooling may need AI-assisted infrastructure sooner rather than later, a point explored in Vitalik Buterin: Without AI, Ethereum’s Lean Roadmap Might Have to Wait Until 2040.
Limitations and what to watch
Buterin was explicit that the current design is not a complete privacy solution. Conversations still pay a meaningful latency cost, especially when starting a new conversation, and Tor is “far from optimal” for this threat model. The cover traffic mechanism works against passive observers, but it is weaker if an LLM provider colludes with a Tor guard and actively manipulates timing. A specialized mixnet with built-in constant cover traffic would be a stronger alternative, he said, even if it requires accepting a higher bandwidth multiplier.
One near-term development to watch is cheaper zkAPI deposit and withdrawal gas costs on Ethereum mainnet. Lower transaction costs could make zkAPI-based privacy features more accessible to smaller agents and everyday users. For developers building autonomous agents on Ethereum, the setup is a working reference for separating payment identity, network routing, and prompt content, even if latency and mixnet maturity remain open challenges.
