Vitalik Built a 'Paranoid Mode' for His AI Agent. Here's What It Still Leaks

Your AI assistant probably knows your portfolio better than your accountant does. That's the problem.

Every prompt you type into a hosted model is a data point, and it lands on somebody else's server. Vitalik Buterin, the Ethereum co-founder, decided he'd had enough of that and built himself a way out. On October 16 he unveiled "paranoid mode" for his personal AI agent, a setup that leans on Tor, a zero-knowledge API layer called zkAPI, and on-device prompt rewriting to obscure who's asking, where the request originates, and how it gets paid for. The code sits on GitHub under his handle.

The honest part is what comes next. Paranoid mode slows down new chats. It still has gaps, and Buterin says so himself. That kind of admission is rare in a corner of tech where everyone claims to have solved privacy.

What it actually does

Three layers, roughly. Tor hides the network origin so the provider can't tie a request to an IP. zkAPI lets you prove you paid for a request without revealing which identity is attached to the payment. Local rewriting massages the prompt on your own machine before it ever leaves, so the raw question never goes out the door verbatim.

Against the obvious threats, that's a decent threat model. IP logging, payment-to-identity linkage, casual prompt inspection. All three get meaningfully harder.

But here's where it gets less impressive. This is a personal hack, not a product. Buterin built it for himself, published the repo, and moved on. No wallet connect flow, no onboarding, no sign-up. Most people reading about this couldn't run it if they tried. That's fine, because the point isn't adoption. The point is proof of concept.

The gaps are the story

Paranoid mode doesn't stop a model provider from reading your prompt once it arrives. Rewriting obscures phrasing, it doesn't encrypt meaning. Paste a seed phrase into a chat window in plain language and no amount of Tor in front of it will save you. Color me skeptical, but "paranoid" is doing some marketing work here.

The question worth asking: what's the real cost of this privacy? Speed, apparently. Buterin says new chats run slower under the mode. That's a tradeoff most retail users will refuse outright, because they've already accepted a free inbox in exchange for their email being scanned for ads. Habit is a stubborn thing.

Then again, the thesis underneath the hack is sound, and it's the part I'd defend. The metadata is the leak. Not the prompt, the metadata. Who asked, when, from where, and with which wallet. That's the stuff most privacy tooling ignores, and it's exactly the stuff that actually deanonymizes people. Buterin aimed at the right target. I'm not entirely convinced zkAPI is production-ready, but the aim is correct.

Who loses? The providers quietly sitting on prompt logs they never expected anyone to question. If this idea spreads, that archive gets a lot less valuable.

Watch the forks

Keep an eye on the repo graph, not the headline. If other builders fork zkAPI and wire it into consumer-facing tools over the next few months, that's the signal to care about. One commit from a famous founder is interesting. A fork graph is a movement.

Time will tell, though. And if nobody picks it up, we'll know the appetite for private AI was mostly talk.