Ethereum co-founder Vitalik Buterin has built an open-source system to improve privacy for AI agents by combining Tor routing, anonymous payments and locally rewritten prompts. Describing the setup on October 16, 2026, he said it was becoming usable for practical work, though starting a conversation still involves considerable delays.
Key takeaways
Buterin’s privacy wrapper supports the OpenAI API interface.
Separate Tor circuits isolate conversations, while extra traffic disguises requests.
zkAPI separates payment authorization from a user’s funding identity.
The code is available on GitHub for use and testing.
How Buterin’s system adds privacy for AI agents
The system places a privacy layer between an AI agent and an external language model service. It combines network routing, payment protection and prompt processing inside a daemon compatible with the OpenAI API .
Buterin described the wrapper for his agent harness, pi, as a “paranoid mode” . He published the code on GitHub, making the implementation available for others to inspect and test.
The components address different ways users can expose information: their network connections, payment records, submitted text and the operating environment available to the agent.
Separate circuits, rewritten prompts and sandbox isolation
Each conversation receives its own Tor circuit , and the system mixes requests with random cover traffic. Buterin said these measures isolate conversations from one another and make genuine AI requests harder to identify through communication patterns.
Tor passes traffic through multiple relays to hide where a connection originates. The added cover traffic is intended to obscure the timing and pattern of requests rather than leave every interaction visible as a distinct network event.
Before text is sent to an external provider, a language model running on the user’s device rewrites the prompt. Users can choose that local model; Buterin’s setup uses qwen3.8-flash-next .
The pi harness also runs inside a bubblewrap, or bwrap, sandbox , a Linux utility that restricts access to parts of a program’s operating environment. Buterin wraps the sandboxed agent with torsocks, which routes supported connections through Tor, intending to prevent direct network connections.
Latency and traffic analysis limit the current design
Buterin acknowledged considerable latency, particularly at the beginning of a conversation. After demonstrating a simple research task, he wrote: “It’s getting quite usable!”
He also distinguished protection against passive observation from protection against a coordinated attack. Random cover traffic offers reasonable protection against passive observers, he said, but cooperation between an AI provider and a Tor guard relay presents a harder problem.
The guard is the first relay a Tor client uses. In Buterin’s scenario, a provider working with that relay could manipulate request and response timing to identify matching traffic patterns, making random cover traffic less effective.
To strengthen privacy for AI agents, Buterin proposed a specialized mixnet with constant cover traffic . That approach would require more bandwidth and generate network activity even without genuine user requests. It remains a proposal rather than an implemented part of his system.
zkAPI protects payments as Ethereum costs are expected to fall
zkAPI uses zero-knowledge proofs to authorize service payments without exposing the user’s funding identity to the model provider. According to Buterin, Ethereum mainnet would soon see much lower gas fees for zkAPI deposit and withdrawal transactions.
The Ethereum Foundation and Open Anonymity Project introduced zkAPI on October 1, 2026, for metered services. The Foundation’s technical announcement describes users depositing funds into an Ethereum vault, then authorizing API usage through proofs.
Short-lived credentials can carry spending limits and cover several requests within a session. The process keeps payment verification distinct from message transmission, since the payment service checks spending permissions without seeing the dialogue, while the model provider receives the prompt but not the identity of whoever is funding it.
The Foundation acknowledged that zkAPI alone does not hide IP addresses or information inside prompts—separate areas addressed by Buterin’s routing and local-rewriting layers.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
