TL;DR
Vitalik Buterin tested a confidential AI agent using local prompt rewriting, Tor routing, background traffic and private zkAPI payments to reduce identity leakage.
The system successfully completed a request for five vegan restaurants in Tallinn and returned results, although additional privacy layers increased latency.
Buterin warned that conventional Tor remains vulnerable to active timing attacks and argued that specialized mixnets, constant background traffic and cheaper zero-knowledge operations are still needed.
Vitalik Buterin detailed an experiment designed to make commercial AI use more confidential by hiding identifying signals across prompts, traffic and payments. In a technical branch on GitHub , the Ethereum co-founder tested a custom client for his Pi AI setup using a “paranoid mode” privacy stack. The experiment extends ideas around Vitalik Buterin and user-controlled computing. The test examined whether an AI agent could remain useful while reducing what external model providers learn about the user.
Buterin Tests Prompt Rewriting, Tor and Anonymous AI Payments
The demonstration asked the agent to identify five vegan restaurants in Tallinn. Before sending the request externally, a local model such as qwen3-8b-flash rewrote the prompt to reduce stylistic fingerprints. The system isolated traffic inside a bwrap sandbox, used torsocks to route connections through Tor and created a separate circuit for each conversation. That design aligns with Buterin’s self-sovereign and private AI . Privacy was built through several local protections rather than relying on one anonymity layer.
The stack also mixed genuine packets with random background traffic and used zkAPI to separate payment from identity when accessing commercial model APIs. The agent completed the restaurant task and returned a structured table based on Google search results, which Buterin described as increasingly usable. zkAPI was introduced as infrastructure for private AI inference using zero-knowledge proofs . The experiment showed that privacy layers could preserve useful agent functionality, although the workflow added latency, especially when opening new sessions.
Buterin also identified a limitation: conventional Tor does not fully protect users against active network attacks. He warned that a model provider manipulating packet timing while coordinating with an entry node could undermine anonymity. His preferred direction is specialized mixnets with constant background traffic, accepting higher bandwidth consumption for stronger protection. That concern fits Ethereum’s work on stronger onchain privacy . The demonstration does not establish that the current architecture provides complete anonymity against sophisticated adversaries.
Economics remain another constraint. Private API payments and zero-knowledge operations add costs, making lower ZK fees relevant to confidential AI agents at scale. The experiment remains an engineering test rather than a finished product, and its results describe one controlled workflow rather than universal protection. Buterin’s test suggests confidential agents can combine prompt processing, network obfuscation and private payments, but stronger network defenses and cheaper cryptographic infrastructure remain necessary before the approach moves beyond experimentation.
