Vitalik Buterin, co-founder of Ethereum, has developed an open-source privacy system for artificial intelligence agents that combines Tor routing, anonymous payments, and locally processed queries to reduce the leakage of user information when accessing large language models.
In a post on X, Buterin stated that he created a “paranoid mode” for his AI agent pi, using zkAPI, random traffic, and a local language model to rewrite queries before they reach an external AI provider.
The setup runs through a daemon compatible with the OpenAI API, allowing the privacy features to operate as a separate layer between the agent and the language model service.
Buterin published the corresponding code on GitHub, though he acknowledged that the system introduces significant delays and remains vulnerable to certain types of traffic analysis.
The AI-based privacy system developed by Vitalik Buterin uses separate Tor channels.
According to Buterin’s technical description, each AI-powered conversation passes through a separate Tor channel, and queries are mixed with random traffic to make it harder to distinguish network activity.
Tor routes internet traffic through multiple relays to hide the source of the connection. In Buterin’s implementation, separate channels provide network isolation between communication sessions.
Additional cover traffic is intended to make it difficult for an observer to identify real AI queries based on communication patterns.
Payment privacy is provided through zkAPI, which, according to Buterin, prevents users from revealing their identity through payment information when accessing artificial intelligence services.
The system includes a local prompt rephrasing mechanism. Before a query reaches the external language model, another model running on the user’s device processes the original text.
Buterin described this feature as a “use your own local model” system, allowing users to choose the model responsible for rewriting their queries.
According to the post, his own system uses qwen3.8-flash-next.
Local rewriting provides a separate layer of protection from the network routing and payment components. However, Buterin did not claim that rewritten queries eliminate any possibility of identifying the user based on the information they provide.
This implementation combines these features within a daemon that supports the OpenAI API interface, allowing the agent to send queries through the privacy shell.
See also:
