Vitalik Buterin’s privacy AI agent setup adds Tor and private payments

What it claims

Vitalik Buterin's "paranoid mode" for his pi agent harness is a daemon that speaks the OpenAI API. It sits between the agent and an external LLM provider, so it should drop in wherever an OpenAI-compatible endpoint is accepted. The code is on GitHub; the article does not give the repository URL. Buterin calls it "getting quite usable!" but reports considerable latency, worst at the start of a conversation.

How it works

Each layer covers a different leak: network origin, payment identity, prompt content, and the agent's own environment.

• Network: one Tor circuit per conversation, mixed with random cover traffic that hides request timing and patterns.
• Prompt: a local model rewrites each prompt before it leaves the device. The model is user-selectable; Buterin uses qwen3.8-flash-next.
• Agent: pi runs in a bubblewrap (bwrap) sandbox, and that sandbox is wrapped in torsocks. Torsocks routes supported connections through Tor, which is meant to block direct network connections.
• Payment (zkAPI):
• The user deposits funds into an Ethereum vault and authorizes API use with zero-knowledge proofs.
• Short-lived credentials carry spending limits and can cover several requests in one session.
• The payment service checks spending permission without seeing the dialogue.
• The provider sees the prompt but not who funded it.

flowchart LR
  A[pi agent in bwrap + torsocks] --> D[OpenAI-API daemon]
  D --> R[Local prompt rewrite]
  R --> T[Per-conversation Tor circuit + cover traffic]
  T --> P[LLM provider]
  V[Ethereum vault deposit] --> Z[zkAPI short-lived credential]
  Z -->|spend check, no dialogue| P

The Ethereum Foundation and the Open Anonymity Project introduced zkAPI for metered services on October 1, 2026.

Limits

• Latency: delays are high, especially when a conversation starts.
• Collusion attack: random cover traffic protects against passive observers only.
• A provider cooperating with the user's Tor guard relay (the first relay) can manipulate request and response timing to match traffic patterns.
• Buterin's proposed fix is a specialized mixnet with constant cover traffic. It costs more bandwidth, generates traffic even when idle, and is a proposal, not part of the shipped system.
• zkAPI scope: the Foundation says zkAPI alone hides neither IP addresses nor prompt content. Those protections depend entirely on the Tor and local-rewrite layers.
• On-chain costs: deposits and withdrawals are Ethereum mainnet transactions. Buterin expects their gas fees to fall "soon", which implies current costs are a factor.
• torsocks gaps: it only routes supported connections. Check that your agent's network calls fall into that category.
• Source quality: this is a secondary news report, produced with AI assistance and editorially reviewed. It gives no benchmarks, latency figures or install steps; go to the GitHub code for those.