Vitalik Buterin’s privacy AI agent setup adds Tor and private payments

What it is

Vitalik Buterin's open-source "paranoid mode" privacy layer for his agent harness, pi. It is an OpenAI-API-compatible daemon between the agent and an external LLM provider. The page says the code is on GitHub but gives no repository URL. Buterin posted it on October 16, 2026 and said it is "getting quite usable."

How it works

Each layer covers a separate leak:

• Network: each conversation gets its own Tor circuit, and random cover traffic is mixed in to obscure timing and request patterns.
• Prompt content: a local model rewrites the prompt before it leaves the device. The model is user-selectable, and Buterin's setup uses qwen3.8-flash-next.
• Host: pi runs in a bubblewrap (bwrap) sandbox wrapped with torsocks, so supported connections go through Tor and direct network connections are meant to be prevented.
• Payment: zkAPI, introduced October 1, 2026 by the Ethereum Foundation and the Open Anonymity Project. Users deposit funds into an Ethereum vault and then authorize usage with zero-knowledge proofs. Short-lived credentials carry spending limits and can cover several requests in a session.

The payment split works like this:

• The payment service checks spending permission but never sees the dialogue.
• The model provider sees the prompt but not who funds it.

Preconditions / Affected

• You need to run pi, or point another agent at an OpenAI-compatible endpoint. The page says only that the daemon is API-compatible, not that other harnesses were tested.
• Linux is needed for bubblewrap.
• You need a local model capable of rewriting prompts.
• You need ETH for zkAPI vault deposits and withdrawals. Buterin says mainnet gas for these should soon fall substantially.

What to do

The page gives no commands or install steps. Pull the code from Buterin's GitHub release and inspect it. It is offered for use and testing, and the page does not describe it as hardened.

Caveats

• Latency: it is considerable, especially at the start of a conversation.
• Guard-collusion gap: random cover traffic helps against passive observers. A provider colluding with a Tor guard relay could manipulate request and response timing to match traffic, and the current design does not defend against this.
• Proposed fix, not built: a specialized mixnet with constant cover traffic. It would cost more bandwidth and generate traffic even when idle.
• zkAPI scope: the Foundation says zkAPI alone hides neither IP addresses nor information inside prompts. Those depend on the Tor and local-rewrite layers.
• Local rewriting: the page gives no evaluation of how well it removes identifying content, so treat it as unmeasured.