Vitalik Buterin's Paranoid Mode AI Agent: Tor, a Local Model and Anonymous Payments
On October 16, Vitalik Buterin showed how his AI agent works in maximum privacy mode: every conversation gets its own Tor circuit, a local model rewrites prompts before they are sent, and the setup proposes paying for requests from an anonymous balance through zkAPI, so the provider has no idea who is paying. We break the setup down step by step: what it hides, where it is honestly weak and what you can borrow from it today.
What Buterin showed
On Friday, October 16, the Ethereum co-founder posted a thread on X about the "paranoid mode" of his AI agent. The agent is pi, a shell Buterin uses to hand tasks to a language model on his own computer. Paranoid mode wraps it in a layer that hides three things at once: where a request comes from, who wrote it and who paid for it.
The code is public, in a branch of his fork of the zkAPI repository on GitHub. Buterin says the setup is becoming quite workable, even though the new version of the payment protocol hasn't been deployed yet, while openly listing its weak spots, which we cover below.
This continues a line of thinking he started in the spring. On April 2, Buterin described his "self-sovereign" setup built on a local model and a sandbox, and warned against feeding your whole life to a cloud AI. On October 1, the Ethereum Foundation and the Open Anonymity Project launched zkAPI, a protocol for paying for AI requests without revealing your identity, and we took a detailed look at how zkAPI lets you pay for AI anonymously. Now all the pieces have come together in one working setup.
How paranoid mode works
- Sandbox and Tor. According to Buterin, the agent runs inside an isolated bubblewrap sandbox, and its network traffic is routed into Tor through torsocks.
- A separate Tor circuit for every conversation. A local daemon, zkapi-clientd, gives each conversation its own Tor "identity". While you keep talking in one conversation, it stays on one circuit; a new conversation gets a new circuit and a new key for the provider. Payments and other background traffic each run under their own separate identities.
- Cover traffic. If you want, the daemon sends ordinary requests through Tor to sites you pick yourself, at random moments and unrelated to anything you do. That way the real request gets lost among fake ones. Cover traffic is off by default, and at the standard rate of five requests per second it can add more than a gigabyte of traffic per hour.
- A local rewriter model. Before a new message goes out, a small model on your own computer rewrites it: it pulls out the task, the context and the constraints and restates them in a neutral style, without unnecessary personal details. Code, numbers, links and quotes stay untouched. The provider receives the rewritten history, while your original wording with its personal quirks never leaves your machine.
- Payment through zkAPI. You top up a balance, the daemon deposits the funds into a vault on Ethereum and then uses a zero-knowledge proof to obtain a short-lived key with a spending limit. The AI provider sees that the request is paid for, but cannot see whose balance it came from.
To applications, all of this looks like an ordinary local OpenAI-compatible API: the agent needs no provider account, no card and no key tied to a name.
Who sees what in this setup
| Party | What it sees | What it doesn't see |
|---|---|---|
| AI provider | rewritten prompts and responses | who you are, your IP and how you pay |
| zkAPI server | that credits were spent and how many | who you are, your prompts and which deposit pays for the requests |
| Ethereum blockchain | vault top-ups and withdrawals of the remaining balance | which requests the money went to |
| Your internet provider | that you use Tor, when, and how much traffic flows | where you send what |
The core idea is that no single party has the full picture. Normally an AI provider holds everything at once: your account, your card, your IP and the history of every conversation in one place.
Where the setup is still weak
Buterin and the documentation that comes with the code are upfront about the limitations, and that is more useful than any amount of hype.
- Latency. Over Tor, responses arrive noticeably slower, especially when a new conversation starts.
- Tor is far from ideal here. Buterin says so himself. Cover traffic gets in the way of a passive observer, but if the provider colludes with a Tor entry node and starts playing with timing, the protection weakens a lot. The document on cover traffic frankly describes it as background noise with no proven protection against traffic analysis. A dedicated mixnet with constant noise would be a better fit, but no such network is ready yet.
- The provider still reads your prompts. The rewriter removes your writing style, though the meaning stays. If the task contains your address, your company name or a contract number, they will be sent along. The documentation says plainly that this does not guarantee anonymity.
- Top-ups are visible on the blockchain. The vault deposit and the withdrawal of the remaining balance are ordinary Ethereum transactions. If you top up from an address linked to your name, that thread remains.
- It is still an experiment. Buterin's branch moves zkAPI to settlement in ETH, the protocol is marked as experimental, and the vault for the new version has not been deployed yet. The Ethereum Foundation's own zkAPI on mainnet currently counts credits in USDC.
Why this matters beyond Buterin
Every question you ask a chatbot is a record in someone else's database. The provider sees your IP, your account, your payment method and your entire chat history, all tied together into a single dossier. And those records don't always stay where you think they do.
In May 2025, a court in the New York Times lawsuit ordered OpenAI to keep all ChatGPT logs, including chats users had deleted. In October 2025 the obligation was lifted going forward, but what had already been saved stayed saved, and data from accounts flagged by the NYT still has to be retained. In the summer of 2025, thousands of ChatGPT chats that people had shared via a link turned up in Google search, some of them personal. OpenAI then removed the option to make such chats visible to search engines altogether.
For crypto holders the risk is concrete. People ask AI about their wallets, amounts and taxes and paste addresses into the chat window. The only people who never paste a seed phrase there are the ones who already know how that ends. And an agent with access to a wallet can cause trouble on its own: we recently covered how an OpenAI agent spent coins from someone else's wallet on its own.
What you can borrow today
You don't have to replicate Buterin's entire setup. A few habits from it work even without Tor and zkAPI.
- Don't give AI anything that links you to your money. A seed phrase, a private key, a screenshot of a wallet with its balance, or the address where your savings sit never go into a chat.
- Handle tasks involving personal data locally. Models that run on a home computer can already deal with emails, spreadsheets and drafts. A cloud model can then get the task once it has been stripped of personal details.
- Keep your addresses separate. If you pay for services in crypto, don't do it from the address that holds your savings. A separate spending address is cheap protection that works.
- Remember that ether is transparent. Every Ethereum transfer is visible to everyone, and zkAPI only hides the link between the deposit and your requests; the deposit itself stays public.
How to get ETH without an exchange account
To top up a balance in a setup like zkAPI, you need ETH on an address you control. Buying it on an exchange with identity verification means tying your deposit to your passport from step one. It is simpler to get ether through a no-KYC crypto exchange that doesn't require an account.
On VertEXchange, swaps work without registration, email or a phone number: you paste your wallet address and see the rate and the exact amount you will receive before you send anything. The coins go straight to your address, and the service does not hold them.
- A fixed rate is held for about 15 minutes while your transfer is being confirmed.
- You can set a refund address in case the swap doesn't go through.
- Personal fields of an operation are deleted 24 hours after it completes, and your swap history is stored only in your browser.
- Support chat is available on every page, and issues are resolved by the swap code.
Most people get ether either from stablecoins, when they need to exchange USDT TRC20 to ETH without registration, or from bitcoin, if it is more convenient to buy ETH with bitcoin straight into their own wallet.
FAQ
What is Buterin's "paranoid mode" for his AI agent?
It is a wrapper for his pi agent: traffic goes through Tor with a separate circuit for each conversation, a local model rewrites prompts before they are sent, and requests are paid for from an anonymous balance through zkAPI. The AI provider doesn't know who is asking the questions or who is paying.
Can I use it right now?
The code is open, but it is an experimental branch: the new ETH-based version of the protocol hasn't been deployed yet, so you can't deposit funds into it for now. The Ethereum Foundation's own zkAPI runs on mainnet with credits in USDC.
Does Tor fully protect you from the AI provider?
No. Tor hides your IP, but Buterin himself writes that for this task it is far from ideal: if the provider colludes with a Tor entry node, requests can be linked by timing. The provider sees the content of your prompts in any case.
Can the blockchain show that I pay for AI through zkAPI?
It shows that you topped up the zkAPI vault and when you withdrew the remaining balance. Which requests and which providers the money went to is not visible on the blockchain.
No email, no account: enter your wallet address, send your coins and get the new ones straight to it.
Exchange USDT to ETH
