Ethereum co-founder Vitalik Buterin published an AI-agent privacy design called “paranoid mode” on October 16, seeking to make it harder for AI providers to identify users through their identities, request origins and payment details. For AI agents connected to wallets or financial tools, those signals could reveal the tokens users are tracking, the assets they hold and their trading plans. Buterin also acknowledged that the design adds latency and remains vulnerable to collusion attacks. The code is public, but the overall system is still experimental.
Four layers target identity, traffic and payment data
The design combines several privacy tools to address different traces that AI requests can leave behind. Tor provides a separate network route for each conversation, helping conceal the user’s IP address. Traffic obfuscation adds decoy requests, making genuine activity harder to distinguish from the broader flow of data.
At the prompt stage, a small AI model running on the user’s device rewrites the input before it is sent to the service. Its purpose is to remove details that could point to an individual. This does not prevent the AI provider from seeing the request; instead, it aims to reduce the amount of identifying information contained in the prompt itself.
For payments, the design uses zkAPI. The approach relies on cryptographic proofs to show that a request has been paid for without directly disclosing the payer’s identity. Together, the four measures address potential links created by network addresses, request patterns, prompt content and payment records.
Financial AI conversations can expose user interests
When an AI agent can access a wallet or financial service, conversations may contain sensitive information. A user might ask about specific tokens or request an analysis of their portfolio, revealing areas of investment interest. Even without providing a name, payment records, network addresses and repeated details across multiple prompts could be used to identify or link the same user.
The design therefore focuses not only on whether conversation content is made public, but also on whether a provider can connect a request to a particular user, network origin or payment record. In financial services, that distinction may affect whether users are willing to hand account or personal-finance queries to AI agents. There is no indication that the design has been broadly deployed or validated.
Buterin flags latency and collusion limits
Adding privacy protections also increases the number of steps in the system and creates practical trade-offs. Buterin said “paranoid mode” would increase latency, while collusion among multiple participants could still allow information to be linked. Tor, traffic obfuscation, local rewriting and zkAPI each address a different category of trace, but none guarantees that a user’s identity will remain hidden in every attack scenario.
The code is available for review, but public availability does not mean the full system is mature. For users, the key questions remain how it performs in practice, how much response time it adds and how much protection it can provide when different service providers coordinate their actions.