Key Takeaways
- Buterin unveiled a privacy-focused AI agent setup combining Tor, zkAPI, and locally processed prompts to protect user identities.
- Ethereum-based zkAPI enables anonymous AI payments using zero-knowledge proofs to conceal links between users and transactions.
- Privacy challenges remain, including slow performance and potential network surveillance, prompting Buterin to explore stronger protections.
Buterin Goes ‘Paranoid Mode’ With Private AI Setup
In an X post Friday, Buterin described a new “paranoid mode” for his Pi AI agent harness, bringing together the Ethereum-based zkAPI payment system, the Tor anonymity network, random cover traffic, and a locally running large language model (LLM).
The experimental configuration is designed to address several ways AI services can identify users, including payment records, IP addresses, recognizable writing patterns, and the contents of submitted prompts.
Each conversation is assigned a separate Tor circuit, while additional randomized network traffic helps obscure genuine requests. Meanwhile, a local AI model rewrites prompts before forwarding them to external services, reducing the likelihood that identifying information reaches the provider.
Buterin said his implementation uses Qwen3.8-Flash-Next for local prompt processing, although the system allows users to substitute their preferred models. The privacy features are bundled into an OpenAI-compatible daemon, allowing them to operate alongside existing AI software.
Buterin also added another layer of security by running the Pi agent harness inside a Bubblewrap sandbox, which restricts its access to the surrounding operating system. The agent’s network connections are routed through Tor using torsocks, while Buterin said he’s experimenting with micro-virtual machines as an additional isolation mechanism.
The setup incorporates zkAPI, a privacy-preserving payment system launched Oct. 1 by the Ethereum Foundation and Open Anonymity Project.
As Bitcoin.com News previously reported, zkAPI uses zero-knowledge proofs to separate payment identities from individual AI requests. Users deposit cryptocurrency, including ETH or USDC, into an Ethereum-based vault and receive private credits that can be spent without linking each transaction to the original funding source.
The service issues temporary API credentials with spending limits, allowing customers to access AI models without maintaining conventional billing identities tied to their requests.
However, zkAPI alone does not provide complete anonymity. AI providers still receive the contents of prompts, while IP addresses, behavioral patterns, and other identifying details can potentially connect otherwise anonymous requests to individual users. Buterin’s latest experiment attempts to address those vulnerabilities by combining payment privacy with network anonymity and local processing.
Still Room for Improvement, Says Ethereum Founder
Despite the additional protections, Buterin acknowledged that his system remains imperfect.
“It’s getting quite usable!” he wrote, adding, “though you definitely still pay quite a bit in increased latency, especially when starting a new conversation.”
He also warned that Tor’s protections could be undermined by sophisticated adversaries. While randomized cover traffic can frustrate passive observers, an AI provider cooperating with a Tor entry relay could potentially manipulate request timing to identify users. Buterin suggested that a purpose-built mixnet, incorporating continuous cover traffic and greater bandwidth, could offer stronger protection against such attacks.
The Ethereum co-founder also said significantly cheaper gas costs for zkAPI deposits and withdrawals are coming to Ethereum mainnet, although he did not provide a timetable or specific figures.
The experiment highlights a growing intersection between cryptocurrency infrastructure and AI agents, demonstrating how blockchain-based payments, privacy networks and locally hosted models could work together to reduce the information exposed when interacting with increasingly powerful AI services.
Buterin’s privacy-centric setup also arrives just as AI giant OpenAI disclosed that an AI agent stole ETH on the Sepolia testnet from a wallet that it did not control—another potential risk with entrusting agents to handle crypto funds. The AI giant said it has implemented additional safeguards to try and prevent such incidents from happening again in the future.
