Ethereum co-founder Vitalik Buterin has published an experimental privacy framework for AI agents that combines onion routing, cover traffic, zero-knowledge payments, and local prompt rewriting. The design is aimed at keeping the use of AI systems from being traced back to the people operating them.

The implementation, a "paranoid mode" wrapper built around an agent harness, is intended to prevent identity leakage along each of the three axes on which AI use can be traceable: what you request, how you pay for it, and where you are making the request from. The work builds on Buterin's earlier experiments in private access to AI and arrives as private AI infrastructure draws growing interest across the blockchain industry.

Inside the Privacy Daemon

The setup revolves around an OpenAI-compatible agent daemon that receives requests from the agent and passes them through local rewriting before submission. According to PCMag Australia, Buterin says the local model he is using is qwen3.8-flash-next, which rewrites prompts to erase identifiable information and stylistic signatures.

Each conversation is assigned its own circuit on Tor, the onion-routing network, to hide network identity, and requests are shuffled with random cover traffic to conceal timing and frequency patterns. Payments are handled through zkAPI, a usage credit protocol developed by the Open Anonymity Project and the Ethereum Foundation. The protocol was integrated into Ethereum mainnet on Oct. 1, as announced on the Ethereum Foundation blog.

zkAPI enables users to top up a private balance and demonstrate sufficient funds via zero-knowledge proofs without linking deposits to individual requests, decoupling billing identity from query data. The agent harness is also sandboxed with bwrap, with MicroVM isolation under experimentation, and wrapped with torsocks to route outbound traffic through Tor.

Taken together, the stack is designed so that the content of a request, the payment behind it, and the network location it comes from cannot be correlated with one another.

Announcing the setup on X, Buterin wrote:

Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi): Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI… pic.twitter.com/2y236zA0cw

— vitalik.eth (@VitalikButerin) October 16, 2026

Why Privacy for AI Agents Matters

The experiment matters because AI agents increasingly act as economic agents, holding funds and interacting with exchanges, protocols, and data sources. If payment credentials, IP addresses, and prompt content can be correlated, agents leak sensitive information about the individuals and organizations behind them.

For developers building autonomous agents on Ethereum and other networks, unlinkable payment rails like zkAPI offer a way to pay for inference and data feeds without exposing wallet balances or behavioral patterns. For institutions exploring AI-driven research and trading agents, the architecture provides a template for operational privacy that aligns with broader demands for confidentiality on public blockchains.

The project also highlights a design tension central to current infrastructure debates: low-latency convenience versus strong anonymity.

Beyond Tor Toward Mixnets

Buterin is explicit about the limitations. Tor was never intended for this application, he notes, and cover traffic can protect against passive adversaries but does little if the LLM provider colludes with the entry guard and captures timing data. Low-latency anonymity networks cannot scale to prevent correlation attacks when an adversary can see both ends of the communication channel.

Source: Carlo Eduardo Oliveieri – Medium

Mixnets — anonymity networks that deliberately delay and reorder messages — together with constant-rate cover traffic, can prevent such attacks, but they come with high bandwidth overhead and added latency. Buterin considers the task better suited to a specialized mixnet, conceding that tradeoff.

Usability is not that far off despite the latency, and improves when starting a new dialogue. Cheaper deposit and withdrawal gas costs for zkAPI are expected to land on mainnet soon. In the near term, the test will be developer adoption of agent harnesses and inference markets.

For Ethereum, the project signals continued commitment to privacy primitives beyond scaling and rollups, with implications for developers, institutional actors, and regulators aligned with the AI-on-chain stack. A successful launch could set standards for confidential agent compensation across the world's biggest blockchain platforms.