AI: Vitalik Buterin Builds an Almost Untraceable Agent

Vitalik Buterin pushes the privacy of his AI agents very far. The co-founder of Ethereum has just unveiled a “paranoiac mode” combining Tor, private payments via zkAPI, dummy network traffic, and local rewriting of prompts. Each conversation goes through a different Tor circuit. Even the payment to the AI provider is designed to no longer directly reveal the user’s identity.

Vitalik Buterin pushes AI privacy even further

This is not the first time Vitalik Buterin has worried about agents’ security. In April, he already warned about risks linked to AI agents and advocated for more local processing and isolated environments. His new setup goes further. Buterin uses Pi as an environment for his AI agent. Around it, he has added several layers designed to prevent a model provider from easily reconstructing the identity of the person sending the requests.

Each new conversation receives its own Tor circuit. Additional random traffic is generated to make genuine requests harder to distinguish in the network stream. Prompts then pass through a locally run model, which can rephrase them before transmitting to the remote model.

Buterin indicates using Qwen3.8-Flash-Next for this stage, while specifying that other models can take its place. The whole system operates behind a service compatible with the OpenAI API. The idea is to add these protections without rebuilding all the software that already use this interface.

Ethereum also masks AI agents’ payments

Tor does not solve everything. A user can hide their IP address, then reveal their identity a few seconds later simply by paying their provider with a named account or an API key associated with their bank card.

This is where zkAPI comes in. The tool was launched on October 1 by the Open Anonymity Project with the Ethereum Foundation. It allows depositing ETH or USDC into a vault on Ethereum, then obtaining private usage credits.

Zero-knowledge proofs are used to demonstrate that a user has enough credit without revealing which deposit specifically finances their request. The AI provider always receives the prompt. However, it does not directly obtain the payment identity hiding behind the temporary key.

This approach fits quite well with the vision Buterin has defended for several months to bring Ethereum and AI closer. His system adds yet another local protection. The Pi agent runs inside a Bubblewrap sandbox to limit its access to the rest of the operating system. Its connections go through Tor with torsocks. Buterin is also testing micro virtual machines to strengthen this isolation. Not really a standard setup to use a chatbot.

The “paranoiac mode” is still imperfect

Buterin does not present his setup as a definitive solution. The first problem: speed. He explains that the configuration becomes usable, but the latency remains noticeably higher, especially when starting a new conversation. Tor, new circuits, local processing, and the various privacy layers have a cost.

The Tor network itself also has limits. An AI provider working with a Tor entry relay could try to analyze or manipulate request timings to correlate some connections. Dummy traffic complicates analysis without making it impossible.

Buterin considers that a specialized mixnet, with more continuous cover traffic, could better address this issue. His experiment comes as Ethereum is already using AI in the other direction. The Foundation has deployed AI agents to track critical flaws in the protocol code, with at least one real vulnerability identified and then fixed. Agents are therefore becoming more useful. They also get more access to files, networks, payments, and sometimes wallets. Buterin prefers to assume that all these layers can end up revealing something. Hence the name: “paranoiac mode.”

DISCLAIMER

The views, thoughts, and opinions expressed in this article belong solely to the author, and should not be taken as investment advice. Do your own research before taking any investment decisions.