Vitalik Buterin shared an experiment that combines Tor, zkAPI, cover traffic, and locally rewritten prompts to make AI agents more private. The Ethereum cofounder explained a privacy-focused wrapper for the Pi agent harness that adds safeguards against request tracking and identity leaks while routing its activity through Tor.

Although it has higher latency and limits against more advanced adversaries that can coordinate their attacks, the setup is starting to be useful for research activities.

Vitalik Buterin Combines Tor & zkAPI for AI Privacy

In his post on X on October 16, 2026, Buterin outlined a method that combines multiple privacy protections into an OpenAI-compatible daemon. The setup uses zkAPI to minimise identity exposure through payments, Tor to route network traffic, and extra cover traffic to make it harder to distinguish real from fake requests.

To keep network activity between discussions separate, each conversation gets its own Tor circuit. Another layer is added by random cover traffic, which makes it more difficult to identify real requests from the surrounding traffic.

The zkAPI component takes care of another issue. Payment conduct may reveal a user's identity even if network traffic is routed via privacy infrastructure. Buterin's setup makes use of zkAPI to assist keep that connection from disclosing the identity of the requester.

Instead of depending solely on network routing, these strategies work together to make it more difficult to link an AI interaction to the person behind it.

Local Prompt Rewriting Adds Another Layer of Protection

Additionally, before sending prompts to the AI provider, the experiment modifies them locally. Before requests leave their computers, users can modify potentially identifying details by providing their own local language model for this process.

Buterin stated that he was rewriting local prompts using Qwen3.8 Flash Next. The strategy is to minimise the quantity of private data that prompts submitted to outside AI services contain.

The distinction is important since prompt privacy and network privacy deal with different risks. Tor does not automatically eliminate identifying information contained in a request, although it can assist in hiding a user's network origin. The goal of local rewriting is to solve that second issue.

Additionally, Buterin introduced torsocks to allow its activity to transit through Tor and wrapped the Pi agent harness in a Bubblewrap sandbox, often known as bwrap. In order to further isolate himself, he claimed to be experimenting with a MicroVM.

Network routing, fast processing, and execution isolation are all integrated into one setup. It is intended to control the agent's interactions with its surroundings and the amount of information disclosed during AI-assisted research.

Wrapped zkAPI + Tor + extra cover traffic + local LLM prompt rewriting in an open-AI compatible daemon, and made a "paranoid mode" wrapper for my agent harness (pi):

Each conversation gets assigned a separate Tor circuit, your requests are masked with random cover traffic, zkAPI ensures you don't leak your identity through payments, and all prompts are locally rewritten (bring-your-own-local-model; I'm using qwen3.8-flash-next)

https://t.co/MepCFCrLv1

My agent harness is wrapped with a bwrap sandbox (also experimenting with MicroVM) and wrapped again with torsocks, so everything it does goes through Tor.

Here's what me asking it to do a simple research task looks like.

It's getting quite usable! Though you definitely still pay quite a bit in increased latency, especially when starting a new conversation.

Also, Tor is far from optimal here for privacy; the cover traffic mechanism is okay against passive adversaries but much weaker if the LLM provider is colluding with the guard and actively manipulating timing. This kind of task really requires a more specialized mixnet, probably take the tradeoff of a higher bandwidth multiplier and built-in constant cover traffic.

Also also, much cheaper zkAPI deposit and withdraw gas costs are coming to mainnet soon.

— vitalik.eth (@VitalikButerin) October 16, 2026

Tor Limitations & Increased Latency Remain Challenges

Buterin acknowledged that private AI interactions are still not a perfect fit for the system. Users still experience significant latency even if the arrangement is becoming feasible for routine research work, especially when initiating a new chat.

Additionally, he cautioned that cover traffic provides more defence against passive observers than it does against an active attacker. Despite the additional noise, an AI provider may be able to correlate traffic if they conspire with a Tor guard and deliberately change request time.

This weakness draws attention to the limitations of integrating current privacy solutions for a task requiring more robust defence against coordinated surveillance. Although cover traffic can complicate surveillance, it does not ensure that timing patterns will stay undetectable under all threat models.

Buterin proposed that private AI requests would likely benefit more from a more specialised mixnet. Constant cover traffic might be an integrated element of such a system, potentially offering more robust protection from traffic analysis at the expense of much increased bandwidth use.

Cheaper zkAPI Transactions Expected on Mainnet

Additionally, there is a payment component to the trial that might become less costly to utilise. Buterin stated that the mainnet will soon have lower gas prices for zkAPI deposits and withdrawals.

For customers using zkAPI as part of a privacy-focused AI workflow, lower transaction costs would solve one practical issue. The announcement did not, however, include a precise launch date or a thorough explanation of the anticipated pricing savings.

The larger experiment combines distinct safeguards for agent execution, payment activity, network identification, and prompt content. Higher latency and bandwidth requirements are now in direct opposition to more stringent privacy objectives. Buterin's assessment also makes clear that Tor alone is not sufficient for the strongest threat models, particularly when an AI provider and network infrastructure can coordinate their observations.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Vitalik’s Bitcoin-Inspired Plan for Ethereum
2. Vitalik Buterin Outlines Ethereum's Lean Vision
3. Vitalik Buterin Explains Cryptography’s “Final Boss”
4. Vitalik Buterin Says Options-Based DeFi Is Already Taking Shape
5. Vitalik Buterin Unveils Analysis on Ethereum's Diverse Layer 2 Landscape

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.